cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions

[marwan-at-work]

Go version: Go 1.12.6

The following command fails:

GOPROXY=https://proxy.golang.org GOPATH=/tempdir go install github.com/golangci/golangci-lint/cmd/golangci-lint

The failure error comes out to be:

build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

It turns out that golangci-lint's go.mod file has an incorrect timestamps in the pseudo-semver version: v0.0.0-20181204210945-1df300866540 because they updated the go.mod file manually which seems to be here (golangci/golangci-lint@7274db7#diff-37aff102a57d3d7b797f152915a6dc16R8)

If you run:

curl https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info

You get

{"Version":"v0.0.0-20190526074819-1df300866540","Time":"2019-05-26T00:48:19-07:00"}

Notice that the timestamp here is 20190526074819 while the golangci's go.mod file is 20181204210945. See here: https://github.com/golangci/golangci-lint/blob/master/go.mod#L8

Since the .info endpoint succeeds and returns a different version, I'm surprised that the Go command did not pick up the new version for the following .zip call. Is this the expected behavior?

Interestingly enough, go mod download doesn't care about the timestamp, and since it's the recommended tool to use, GOPROXY=off and GOPROXY=<athens> succeed but proxy.golang.org fails.

cc: @fsouza

[heschi]

Thanks for the excellent report. This looks like a bug in the go command to me:

$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
go: finding github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20190526074819-1df300866540.mod
go: downloading github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip
build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

Note that it uses the canonicalized pseudoversion to download the .mod, but not the .zip. I'd like to hear an opinion from @bcmills @jayconrod on what's going on here. I think we may have to support these kinds of requests in proxy.golang.org though.

[bcmills]

This is closely related to #27173. I'm still investigating how frequent these are in practice.

With the current draft of CL 181881, I get a more consistent failure using the proxy:

example.com$ go mod init example.com
go: creating new go.mod: module example.com

example.com$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request (0.119s)
        github.com/go-critic/[email protected]: reading https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request

[bcmills]

Note specifically the fixes to (*modfetch.codeRepo).GoMod and (*modfetch.codeRepo).Zip in that CL.

[gopherbot]

Change https://golang.org/cl/181881 mentions this issue: cmd/go: validate pseudo-versions against module paths and revision metadata