What is going on with v3?

[bouk]

Hi, I want to adopt this module for my project, but I'm a bit unclear about what's happening. It seems you've forked it to go-jose/go-jose, but then that one still has the module name github.com/square/go-jose so I can't import it (with go get -u github.com/go-jose/go-jose/v3@master).

How am I supposed to use it?

[giautm]

Hi, give a try for go get -u github.com/square/go-jose/v3

[pkieltyka]

Very surprised to see this repo take such a turn for the worst. Why was a new repo formed and then contents deleted from here when the new repo doesn't even build? such a shame.

[csstaub]

Hi @pkieltyka, I migrated the dev version of the code to a new repo since I don't work at Square anymore and don't have access to the Square org hence. The currently supported version is v2, the v3 one is still in development and I wouldn't recommend it for active use.

[csstaub]

Also the content from the master branch was deleted so that folks don't use it since it wasn't stable -- the stable version is in the v2 branch, which is required due to how Go modules work. Make sure to import the package via gopkg.in and pin to v2 so your code won't randomly break.

[csstaub]

@mbyczkowski -- can we set the default branch to be the v2 branch? Should avoid some confusion.

[pkieltyka]

Thanks for the update. Are you planning to continue to support https://github.com/go-jose/go-jose? if not, perhaps mention that you're looking for new maintainers, or even ask if Square plans to hire someone to maintain it? as it is an important library and seems to be orphaned.

FYI: for others following the thread, you may also want to look at https://github.com/lestrrat-go/jwx which is a high quality alternative library

[csstaub]

The current version (v2 branch, at square/go-jose) is still supported and will continue to receive security patches, I wouldn't call it orphaned. The v3 branch (at go-jose/go-jose) exists for new feature contributions that are backwards-incompatible and would require changing interfaces (e.g. removing some of the interface{} type-casting). Contributions are definitely welcome if someone would like to step up and help with maintenance.

[BlueGGuy]

For me the inability to use Github to search code is my major gripe. Forked repositories are not searchable only the empty default branch is searchable on square.