cmd/go/internal/modfetch: unzip dependency files read-only

The Go community are accustomed to editing Go packages where they are
checked out in the GOPATH. With depedencies populated into the GOPATH by
vgo, editing the Go packages where they are is not the best practice.
This is because the path that the dependencies are written to within the
GOPATH are directories with explicit version names, and to change the
contents of the directory would cause the directory name to lie about
its contents.

Example:
~/go/src/v/github.com/owner/repo@v0.0.0-20180105044528-9d5d1c7387b7

The best practice with vgo is to manually checkout the project at
another path and add a replace directive to your Go module referencing
that local copy.

Because Go developers are accustomed to editing dependencies where go
get places them in the GOPATH, speaking from my own experience, they
will make the mistake of editing the files in these directories. IDEs
faciliate this mistake because most IDEs will allow you to find
references and go to definitions in dependencies.

Setting the file permissions of files checked out in the vgo path
communicates the intent and prevents developers from accidentally
editing those files.

Fixes golang/go#24111

Change-Id: I65bb07722d5093902965d2989e92dd39a9bd0020
Reviewed-on: https://go-review.googlesource.com/96978
Reviewed-by: Russ Cox <rsc@golang.org>
1 file changed
tree: c3536b352010170ff2da4e049d944b79e65c3f2d
  1. vendor/
  2. AUTHORS
  3. codereview.cfg
  4. CONTRIBUTING.md
  5. CONTRIBUTORS
  6. LICENSE
  7. main.go
  8. PATENTS
  9. README.md
README.md

Versioned Go Prototype (vgo)

This repository holds a prototype of what the go command might look like with integrated support for package versioning.

See research.swtch.com/vgo for documents about the design.

Download/Install

Use go get -u golang.org/x/vgo.

You can also manually git clone the repository to $GOPATH/src/golang.org/x/vgo.

Report Issues / Send Patches

See CONTRIBUTING.md.

This is still a very early prototype. You are likely to run into bugs. Please file bugs in the main Go issue tracker, golang.org/issue, and put the prefix x/vgo: in the issue title.

Thank you.