Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create Unpublish specific version - Solution proposal.md #875

Merged
merged 13 commits into from
Jul 2, 2024

Conversation

seaniyer
Copy link
Collaborator

Initial draft

@alisonatwork
Copy link

alisonatwork commented Mar 26, 2024

This looks fantastic! Thank you so much for getting this on the agenda.

My only concern with the spec as it stands at the moment is the two points about how unpublishing all the versions should have the same behavior as the current unpublish action. I guess there are two conflicting use cases here.

  1. User unpublishes all current published versions, but still intends to publish a new version of the same extension.
  2. User intends to delete the extension altogether.

Right now the unpublish behavior assumes case 2. The problem with case 2 - as I have painfully discovered when I accidentally blew away an extension with thousands of installs - is that even if you republish again with the exact same name and marketplace token, existing users of that extension cannot upgrade, because it's considered an entirely new extension.

On one hand, this behavior is good, because it means if someone unpublishes an extension then a bad actor can't come along and hijack the namespace without the existing users explicitly uninstalling and reinstalling that extension. On the other hand, for the legitimate scenario as described in case 1, above, this leaves a potentially large number of users stuck on broken or out of date versions.

If unpublishing versions and removing extensions were two separate operations, this situation could be avoided.

Thanks again for taking a look at this.

@tooltitude-support
Copy link

tooltitude-support commented Mar 26, 2024

Looks really great! Thank you!

I would add one more important use case: You want to remove a really old version to reduce support burden on the publisher. So, I would avoid putting 1K download limit.

@alexangas
Copy link

This looks great, apart from the wording restricting it to VS Code extensions. The VS Marketplace also provides extensions for Visual Studio and Azure DevOps, who would also greatly benefit from this. Is there any possibility of including the three types of extensions rather than restricting it? The original issue does not state the purpose was solely for VS Code.

Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
Unpublish specific version - Solution proposal.md Outdated Show resolved Hide resolved
@starball5
Copy link

starball5 commented Mar 30, 2024

Related on SO: I've published a wrong version number to VSCode marketplace. Best way to handle/downgrade version number?

What would happen for users who already installed a version which subsequently gets unpublished? Would VS Code automatically rollback / upgrade (if available)? (related)

@seaniyer
Copy link
Collaborator Author

seaniyer commented Apr 2, 2024

This looks great, apart from the wording restricting it to VS Code extensions. The VS Marketplace also provides extensions for Visual Studio and Azure DevOps, who would also greatly benefit from this. Is there any possibility of including the three types of extensions rather than restricting it? The original issue does not state the purpose was solely for VS Code.

@alexangas Good question! Version history is only supported for VS Code extensions. For example, in case of VS only the latest extension version (not referring to VS version) can be installed. That's the reason behind Unpublishing a specific version being scoped to VS Code at this time.

@seaniyer
Copy link
Collaborator Author

seaniyer commented Apr 3, 2024

Related on SO: I've published a wrong version number to VSCode marketplace. Best way to handle/downgrade version number?

What would happen for users who already installed a version which subsequently gets unpublished? Would VS Code automatically rollback / upgrade (if available)? (related)

FYI @isidorn @sandy081 @joaomoreno

seaniyer and others added 7 commits April 2, 2024 17:26
Co-authored-by: Antonio <bandantonio@users.noreply.github.com>
Co-authored-by: Antonio <bandantonio@users.noreply.github.com>
Co-authored-by: Antonio <bandantonio@users.noreply.github.com>
Co-authored-by: Antonio <bandantonio@users.noreply.github.com>
change to the outcome of unpublishing all versions.
@seaniyer
Copy link
Collaborator Author

seaniyer commented Apr 3, 2024

This looks fantastic! Thank you so much for getting this on the agenda.

My only concern with the spec as it stands at the moment is the two points about how unpublishing all the versions should have the same behavior as the current unpublish action. I guess there are two conflicting use cases here.

  1. User unpublishes all current published versions, but still intends to publish a new version of the same extension.
  2. User intends to delete the extension altogether.

Right now the unpublish behavior assumes case 2. The problem with case 2 - as I have painfully discovered when I accidentally blew away an extension with thousands of installs - is that even if you republish again with the exact same name and marketplace token, existing users of that extension cannot upgrade, because it's considered an entirely new extension.

On one hand, this behavior is good, because it means if someone unpublishes an extension then a bad actor can't come along and hijack the namespace without the existing users explicitly uninstalling and reinstalling that extension. On the other hand, for the legitimate scenario as described in case 1, above, this leaves a potentially large number of users stuck on broken or out of date versions.

If unpublishing versions and removing extensions were two separate operations, this situation could be avoided.

Thanks again for taking a look at this.

Solution proposal updated to reflect # 1. Good call out!

- Unpublishing a version does not remove any data including acquistion numbers, ratings, reviews and Q&A that may have been posted while the version was published.
- The unpublish action cannot be undone*. The same extension name and version combination can never be reused to publish*.
- If all versions of a package have been individually unpublished, the extension becomes unavailable on the Marketplace (not found by search or not accessible via a direct link to the details page). However:
- The publisher still retains ownership of the extension name so they can continue to publish newer versions.
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, Sean, I think this will be much-appreciated.


Publishers need a way to take back a certain version of their VS Code extension that has problems due to release pipeline issues or needs to be recalled because of serious security or legal issues. Right now on VS Marketplace (VSM) developers can only remove their whole extension, which makes it inaccessible to the public, and this can cause problems and confusion for both the developers and the users. The most upvoted [request on GitHub](https://github.com/microsoft/vsmarketplace/issues/235) from customers today is the ability to remove a certain version. This feature would let developers take out faulty versions of their extension from the VSM, while leaving the previous and next versions available. This way, developers can fix the problem and publish a new version, without affecting the users who are using the working versions of the extension. Users would benefit from this feature, as they would not see the broken version of the extension in the VSM, and they would be able to update to the newest version without any trouble.

## Top problem scenarios
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What should be the client strategy when a specific version is unpublished? Lets say, if a user has already installed that version how does the client behave when that specific version is unpublished in each mentioned following scenarios or in general?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@isidorn
Copy link
Collaborator

isidorn commented Apr 5, 2024

@seaniyer Sandeep and me just discussed this and overall this makes good sense from the VS Code point of view, and we are excited about Marketplace picking this one up.

The only open question is the one Sandeep raised - what should VS Code do when the a specific version is unpublished, if that version is being used by the user.

  • After discussing with Sandeep, we believe that VS Code needs to react and downgrade the user to the highest unpublished version. We can discuss if Marketplace needs to update the current query that returns a list of versions (to specify if a version has been unpublished), or if VS Code should figure this out by making some assumptions (seeing that the latest available version from MP is lower than the current running extension version).
  • Also what if the last version is unpublished - than your assumption is that the whole extensions gets unpublished. How would client react to that? We propose to do the same thing we do today when the whole extension gets unpublished, and that is a no-op. Leave the extension running, but we might need to notify the user.

@sandy081 let me know if I missed something from our discussion. Thank you

@seaniyer
Copy link
Collaborator Author

seaniyer commented Apr 10, 2024

@seaniyer Sandeep and me just discussed this and overall this makes good sense from the VS Code point of view, and we are excited about Marketplace picking this one up.

The only open question is the one Sandeep raised - what should VS Code do when the a specific version is unpublished, if that version is being used by the user.

  • After discussing with Sandeep, we believe that VS Code needs to react and downgrade the user to the highest unpublished version. We can discuss if Marketplace needs to update the current query that returns a list of versions (to specify if a version has been unpublished), or if VS Code should figure this out by making some assumptions (seeing that the latest available version from MP is lower than the current running extension version).
  • Also what if the last version is unpublished - than your assumption is that the whole extensions gets unpublished. How would client react to that? We propose to do the same thing we do today when the whole extension gets unpublished, and that is a no-op. Leave the extension running, but we might need to notify the user.

@sandy081 let me know if I missed something from our discussion. Thank you

@isidorn @sandy081
After discussing with @sbanni and @lyndaidaii on the Marketplace team, we are in agreement with these two proposed approaches on VS Code side:

  • VS Code needs to react and downgrade the user to the highest unpublished version
  • no-op on the client side when all versions have been unpublished (same as the whole extension is unpublished)
    We are going to investigate updating the API to return a list of versions with unpublished/published marked.

Thanks also to @starball5 for raising the same client-side questions.

@seaniyer seaniyer merged commit b7b9277 into main Jul 2, 2024
1 check passed
@atul-exceeds
Copy link

atul-exceeds commented Sep 27, 2024

This is awesome. Can some visibility be shared on will this be done?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

9 participants