aboutsummaryrefslogtreecommitdiff
path: root/src/cmd/go/internal/modfetch/coderepo_test.go
AgeCommit message (Collapse)Author
2022-03-03[release-branch.go1.16] cmd/go: avoid +incompatible major versions if a ↵Bryan C. Mills
go.mod file exists in a subdirectory for that version Previous versions of the 'go' command would reject a pseudo-version passed to 'go get' if that pseudo-version had a mismatched major version and lacked a "+incompatible" suffix. However, they would erroneously accept a version *with* a "+incompatible" suffix even if the repo contained a vN/go.mod file for the same major version, and would generate a "+incompatible" pseudo-version or version if the user requested a tag, branch, or commit hash. This change uniformly rejects "vN.…" without "+incompatible", and also avoids resolving to "vN.…+incompatible", when vN/go.mod exists. To maintain compatibility with existing go.mod files, it still accepts "vN.…+incompatible" if the version is requested explicitly as such and the repo root lacks a go.mod file. Fixes #51331 Updates #51324 Updates #36438 Change-Id: I2b16150c73fc2abe4d0a1cd34cb1600635db7139 Reviewed-on: https://go-review.googlesource.com/c/go/+/387675 Trust: Bryan Mills <bcmills@google.com> Reviewed-by: Michael Matloob <matloob@golang.org> (cherry picked from commit 5a9fc946b42cc987db41eabcfcbaffd2fb310d94) Reviewed-on: https://go-review.googlesource.com/c/go/+/387923 Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2022-02-07[release-branch.go1.16] cmd/go/internal/modfetch: do not short-circuit ↵Bryan C. Mills
canonical versions Since at least CL 121857, the conversion logic in (*modfetch).codeRepo.Stat has had a short-circuit to use the version requested by the caller if it successfully resolves and is already canonical. However, we should not use that version if it refers to a branch instead of a tag, because branches (unlike tags) usually do not refer to a single, stable release: a branch named "v1.0.0" may be for the development of the v1.0.0 release, or for the development of patches based on v1.0.0, but only one commit (perhaps at the end of that branch — but possibly not even written yet!) can be that specific version. We already have some logic to prefer tags that are semver-equivalent to the version requested by the caller. That more general case suffices for exact equality too — so we can eliminate the special-case, fixing the bug and (happily!) also somewhat simplifying the code. Updates #35671 Fixes #50686 Fixes CVE-2022-23773 Change-Id: I2fd290190b8a99a580deec7e26d15659b58a50b0 Reviewed-on: https://go-review.googlesource.com/c/go/+/378400 Trust: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> Reviewed-by: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> (cherry picked from commit fa4d9b8e2bc2612960c80474fca83a4c85a974eb) Reviewed-on: https://go-review.googlesource.com/c/go/+/382839
2020-12-09all: update to use os.ReadFile, os.WriteFile, os.CreateTemp, os.MkdirTempRuss Cox
As part of #42026, these helpers from io/ioutil were moved to os. (ioutil.TempFile and TempDir became os.CreateTemp and MkdirTemp.) Update the Go tree to use the preferred names. As usual, code compiled with the Go 1.4 bootstrap toolchain and code vendored from other sources is excluded. ReadDir changes are in a separate CL, because they are not a simple search and replace. For #42026. Change-Id: If318df0216d57e95ea0c4093b89f65e5b0ababb3 Reviewed-on: https://go-review.googlesource.com/c/go/+/266365 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-10-28cmd/go/internal/modfetch: drop gopkg.in/russross/blackfriday.v2 from ↵Tobias Klauser
TestCodeRepoVersions Follow-up for CL 265819. Given the -pre tag added recently, a new stable version is likely tagged soon. This would break TestCodeRepoVersions on the longtest builders again. Since the other test cases in codeRepoVersionsTests already provide enough coverage, drop gopkg.in/russross/blackfriday.v2 to avoid breaking TestCodeRepoVersions once the release happens. Updates #28856 Change-Id: If86a637b5e47f59faf9048fc1cbbae6e8f1dcc53 Reviewed-on: https://go-review.googlesource.com/c/go/+/265917 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-28cmd/go/internal/modfetch: update expected tags for TestCodeRepoVersionsTobias Klauser
Updates #28856 Change-Id: I89c564cefd7c5777904bc00c74617dab693373bf Reviewed-on: https://go-review.googlesource.com/c/go/+/265819 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Alberto Donizetti <alb.donizetti@gmail.com> Reviewed-by: Bryan C. Mills <bcmills@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-13cmd/go/internal/modfetch: remove error return from LookupBryan C. Mills
We generally don't care about errors in resolving a repo if the result we're looking for is already in the module cache. Moreover, we can avoid some expense in initializing the repo if all of the methods we plan to call on it hit in the cache — especially when using GOPROXY=direct. This also incidentally fixes a possible (but rare) bug in Download: we had forgotten to reset the downloaded file in case the Zip method returned an error after writing a nonzero number of bytes. For #37438 Change-Id: Ib64f10f763f6d1936536b8e1f7d31ed1b463e955 Reviewed-on: https://go-review.googlesource.com/c/go/+/259158 Trust: Bryan C. Mills <bcmills@google.com> Trust: Jay Conrod <jayconrod@google.com> Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Michael Matloob <matloob@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2020-04-08cmd/go: allow configuring module cache directory with GOMODCACHEMichael Matloob
Adds a GOMODCACHE environment variable that's used by cmd/go to determine the location of the module cache. The default value of GOMODCACHE will be GOPATH[0]/pkg/mod, the default location of the module cache before this change. Replace the cmd/go/internal/modfetch.PkgMod variable which previously held the location of the module cache with the new cmd/go/internal/cfg.GOMODCACHE variable, for consistency with many of the other environment variables that affect the behavior of cmd/go. (Most of the changes in this CL are due to moving/renaming the variable.) The value of cfg.GOMODCACHE is now set using a variable initializer. It was previously set in cmd/go/internal/modload.Init. The location of GOPATH/pkg/sumdb is unchanged by this CL. While it was previously determined using the value of PkgMod, it now is determined independently dirctly from the value of GOPATH[0]. Fixes #34527 Change-Id: Id4d31d217b3507d6057c8ef7c52af1a0606603e4 Reviewed-on: https://go-review.googlesource.com/c/go/+/219538 Run-TryBot: Michael Matloob <matloob@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-11-05cmd/go/internal/modfetch: prune +incompatible versions more aggressivelyBryan C. Mills
codeRepo.Versions previously checked every possible +incompatible version for a 'go.mod' file. That is wasteful and counterproductive. It is wasteful because typically, a project will adopt modules at some major version, after which they will (be required to) use semantic import paths for future major versions. It is counterproductive because it causes an accidental '+incompatible' tag to exist, and no compatible tag can have higher semantic precedence. This change prunes out some of the +incompatible versions in codeRepo.Versions, eliminating the “wasteful” part but not all of the “counterproductive” part: the extraneous versions can still be fetched explicitly, and proxies may include them in the @v/list endpoint. Updates #34165 Updates #34189 Updates #34533 Change-Id: Ifc52c725aa396f7fde2afc727d0d5950acd06946 Reviewed-on: https://go-review.googlesource.com/c/go/+/204439 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-11-05cmd/go/internal/modfetch: remove non-hermetic testBryan C. Mills
The test for gopkg.in/yaml.v2@v2 assumes that there are no future upstream releases. That assumption empirically does not hold. Backporting fixes to this test is annoying, and other gopkg.in cases are already reasonably covered, so remove the problematic test. Updates #28856 Change-Id: I6455baa1816ac69e02d1ad5d03b82a93e1481a17 Reviewed-on: https://go-review.googlesource.com/c/go/+/205437 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-11-01cmd/go/internal/modfetch: add zip sums and hashes to TestCodeRepoJay Conrod
Updates #35290 Change-Id: I09cad17f09e78c2bf6a9de98b01f13ed383ca006 Reviewed-on: https://go-review.googlesource.com/c/go/+/204643 Run-TryBot: Jay Conrod <jayconrod@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2019-10-03cmd/go/internal/modfetch: update TestCodeRepo for gopkg.in/yaml.v2 againTobias Klauser
Update the expected data to fix the longtest builder. Updates #28856 Change-Id: I7fb6ee72e8469d974561b4b4057f40142f5b3654 Reviewed-on: https://go-review.googlesource.com/c/go/+/198557 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-10-01cmd/go/internal/modfetch: update TestCodeRepo for gopkg.in/yaml.v2Andrew Bonventre
The new yaml.v2 release broke the longtest builder. Update the expected data. Updates #28856 Change-Id: I98ec9e32e55bdb6b26b67e46dc16f34f77c2d40f Reviewed-on: https://go-review.googlesource.com/c/go/+/198117 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-07-16cmd/go: tighten the check for pseudo-version base tagsBryan C. Mills
Do not allow a pseudo-version derived from a canonical tag to refer to the same revision as the tag itself. It's unnecessary (because canonical tags already have a total ordering) and confusing (the pseudo-version appears to come after the tag, but actually refers to the exact same revision). Updates #32879 Updates #27173 Change-Id: I02befedbe89c8819bdd93e470783ce63fc813193 Reviewed-on: https://go-review.googlesource.com/c/go/+/184720 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-07-15cmd/go/internal/modfetch: always check for a go.mod file when fetching from ↵Bryan C. Mills
version control If the module path declared in the go.mod file does not match the path we are trying to resolve, a build using that module is doomed to fail. Since we know that the module path does not match in the underlying repo, we also know that the requested module does not exist at the requested version. Therefore, we should reject that version in Stat with a “not exist” error — sooner rather than later — so that modload.Query will continue to check other candidate paths (for example, with a major-version suffix added or removed). Fixes #33099 Change-Id: I43c980f78ed75fa6ace90f237cc3aad46c22d83a Reviewed-on: https://go-review.googlesource.com/c/go/+/186237 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-06-24cmd/go/internal/modfetch: treat a missing go.mod file as a “not exist” errorBryan C. Mills
If we have found a repository at the requested version but it does not contain a go.mod file in an appropriate subdirectory, then the module with the given path does not exist at that version. Therefore, we should report it with an error equivalent to os.ErrNotExist so that modload.Query will continue to check other possible module paths. Updates #27173 Change-Id: Ica73f4bb97f58e611a7f7d38183ee52fef5ee69a Reviewed-on: https://go-review.googlesource.com/c/go/+/183618 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-06-21cmd/go: validate pseudo-versions against module paths and revision metadataBryan C. Mills
Previously, most operations involving pseudo-versions allowed any arbitrary combination of version string and date, and would resolve to the underlying revision (typically a Git commit hash) as long as that revision existed. There are a number of problems with that approach: • The pseudo-version participates in minimal version selection. If its version prefix is inaccurate, the pseudo-version may appear to have higher precedence that the releases that follow it, effectively “pinning” the module to that commit. For release tags, module authors are the ones who make the decision about release tagging; they should also have control over the pseudo-version precedence within their module. • The commit date within the pseudo-version provides a total order among pseudo-versions. If it is not accurate, the pseudo-version will sort into the wrong place relative to other commits with the same version prefix. To address those problems, this change restricts the pseudo-versions that the 'go' command accepts, rendering some previously accepted-but-not-canonical versions invalid. A pseudo-version is now valid only if all of: 1. The tag from which the pseudo-version derives points to the named revision or one of its ancestors as reported by the underlying VCS tool, or the pseudo-version is not derived from any tag (that is, has a "vX.0.0-" prefix before the date string and uses the lowest major version appropriate to the module path). 2. The date string within the pseudo-version matches the UTC timestamp of the revision as reported by the underlying VCS tool. 3. The short name of the revision within the pseudo-version (such as a Git hash prefix) is the same as the short name reported by the underlying cmd/go/internal/modfetch/codehost.Repo. Specifically, if the short name is a SHA-1 prefix, it must use the same number of hex digits (12) as codehost.ShortenSHA1. 4. The pseudo-version includes a '+incompatible' suffix only if it is needed for the corresponding major version, and only if the underlying module does not have a go.mod file. We believe that all releases of the 'go' tool have generated pseudo-versions that meet these constraints. However, a few pseudo-versions edited by hand or generated by third-party tools do not. If we discover invalid-but-benign pseudo-versions in widely-used existing dependencies, we may choose to add a whitelist for those specific path/version combinations. ― To work around invalid dependencies in leaf modules, users may add a 'replace' directive from the invalid version to its valid equivalent. Note that the go command's go.mod parser automatically resolves commit hashes found in 'replace' directives to the appropriate pseudo-versions, so in most cases one can write something like: replace github.com/docker/docker v1.14.0-0.20190319215453-e7b5f7dbe98c => github.com/docker/docker e7b5f7dbe98c and then run any 'go' command (such as 'go list' or 'go mod tidy') to resolve it to an appropriate pseudo-version. Note that the invalid version will still be used in minimal version selection, so this use of 'replace' directives is an incomplete workaround. ― One of the common use cases for higher-than-tagged pseudo-versions is for projects that do parallel development on release branches. For example, if a project cuts a 'v1.2' release branch at v1.2.0, they may want future commits on the main branch to show up as pre-releases for v1.3.0 rather than for v1.2.1 — especially if v1.2.1 is already tagged on the release branch. (On the other hand, a backport of a patch to the v1.2 branch should not show up as a pre-release for v1.3.0.) To address this use-case, module authors can make use of our existing support for pseudo-versions derived from pre-release tags: if the author adds an explicit pre-release tag (such as 'v1.3.0-devel') to the first commit after the branch, then the pseudo-versions for that commit and its descendents will be derived from that tag and will sort appropriately in version selection. ― Updates #27171 Fixes #29262 Fixes #27173 Fixes #32662 Fixes #32695 Change-Id: I0d50a538b6fdb0d3080aca9c9c3df1040da1b329 Reviewed-on: https://go-review.googlesource.com/c/go/+/181881 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-06-10cmd/go: in tests, don't assume that the 'git' binary is presentBryan C. Mills
Add a helper-function to testenv to make these skips more ergonomic. Also update a few existing skips in cmd/go/... to use it. Updates #25300 Change-Id: I4205b4fb2b685dfac1cff3c999f954bff7b0f3c1 Reviewed-on: https://go-review.googlesource.com/c/go/+/181538 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-05-24cmd/go: when resolving packages, try all module paths before falling back to ↵Bryan C. Mills
the next proxy Since we're mucking with error-propagation in modload.Query* anyway, simplify the classification logic. Ensure that “module not found” errors are reported as such in various places, since non-“not found” errors terminate the module search. Fixes #31785 Change-Id: Ie3ca5f4eec10a5f2a6037ec7e1c2cf47bd37a232 Reviewed-on: https://go-review.googlesource.com/c/go/+/177958 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2019-05-13cmd/go/internal/modfetch: fix GOSUMDB test failuresBryan C. Mills
Use cfg.GOSUMDB consistently instead of re-resolving it from the environment. Set cfg.GOSUMDB to 'off' explicitly in coderepo_test, since it may include modules that cannot be fetched using a released version of the 'go' command. Fixes #31964 Change-Id: I17cae9e0c6aa1168ba534e6da4e3652800ac81e5 Reviewed-on: https://go-review.googlesource.com/c/go/+/176538 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-04-03cmd/go/internal/modfetch: replace nanomsg.org with vcs-test in TestCodeRepoBryan C. Mills
nanomsg.org currently performs an HTTPS-to-HTTP redirect, so this case fails after the fix for #29591. Updates #29591 Change-Id: I6306d378ef213e98c0271258bbc6669bb33f9021 Reviewed-on: https://go-review.googlesource.com/c/go/+/170637 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-04-03cmd/go/internal/lockedfile: add a sync.Mutex to lockedfile.MutexBryan C. Mills
The compiler (and race detector) don't interpret locking a file as a synchronization operation, so we add an explicit (and redundant) sync.Mutex to make that property clear. The additional synchronization makes it safe to parallelize the tests in cmd/go/internal/modfetch/coderepo_test.go, which cuts the wall time of that test by around 50%. Updates #30550 Change-Id: Ief3479020ebf9e0fee524a4aae5568697727c683 Reviewed-on: https://go-review.googlesource.com/c/go/+/170597 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Reviewed-by: Jay Conrod <jayconrod@google.com>
2019-03-21cmd/go/internal/modfetch: update TestCodeRepo for gopkg.in/yaml.v2Alberto Donizetti
New release, it broke again the longtest builder. Align the expected data with the current release. Making these tests independent of external repositories is #28856. This fixes the longtest builder. Updates #28856 Change-Id: I32d2f3325af828d26ab417a5e986e3aeefa1a897 Reviewed-on: https://go-review.googlesource.com/c/go/+/168561 Run-TryBot: Alberto Donizetti <alb.donizetti@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-03-13cmd/go/internal/{modconv,modfetch,modload}: set modfetch proxy URL in testsBryan C. Mills
Fixes #30571 Change-Id: Id4c74e83ee58a080d1c2894ae5ebdbf4aeb1ce42 Reviewed-on: https://go-review.googlesource.com/c/go/+/167084 Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-03-08cmd/go/internal/modfetch: handle codeRoot == path for paths with ↵Bryan C. Mills
major-version suffixes Fixes #30647 Change-Id: Icbcfdb3907bc003ac17a8c7df17ecb41daf82eb4 Reviewed-on: https://go-review.googlesource.com/c/go/+/166117 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
2018-12-10cmd/go/internal/modfetch: update TestCodeRepo for gopkg.in/yaml.v2 v2.2.2Bryan C. Mills
I think we ought to make these tests hermetic, but in the meantime we should at least make them pass. Fixes #27692 Updates #28856 Change-Id: Ia78fa60e998dea3c871f640ffa2ece67b054f866 Reviewed-on: https://go-review.googlesource.com/c/153460 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2018-11-29cmd/go/internal/modfetch: make Repo.Zip write to an io.Writer instead of a ↵Bryan C. Mills
temporary file This will be used to eliminate a redundant copy in CL 145178. (It also decouples two design points that were previously coupled: the destination of the zip output and the program logic to write that output.) Updates #26794 Change-Id: I6cfd5a33c162c0016a1b83a278003684560a3772 Reviewed-on: https://go-review.googlesource.com/c/151341 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2018-09-27cmd/go/internal/modfetch: update expected tags for external reposAlberto Donizetti
Updates #27692 Change-Id: Ia32b9e401dfe1fbb64b7f1311d85b7a1ab959bc0 Reviewed-on: https://go-review.googlesource.com/137775 Run-TryBot: Alberto Donizetti <alb.donizetti@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2018-09-26all: use strings.ReplaceAll and bytes.ReplaceAll where applicableBrad Fitzpatrick
I omitted vendor directories and anything necessary for bootstrapping. (Tested by bootstrapping with Go 1.4) Updates #27864 Change-Id: I7d9b68d0372d3a34dee22966cca323513ece7e8a Reviewed-on: https://go-review.googlesource.com/137856 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-08-17cmd/go/internal/modfetch: correct TestCodeRepo expectationRuss Cox
The proxy protocol was simplified to only send (and only receive) the Path and Version fields in the JSON blob, not Name and Short. (Those make sense when querying a VCS repo directly, but not when talking about extracted modules.) So don't expect them in the test. Fixes #27042. Change-Id: I3daacd668126e2227dcc8e6b89ee0cf0e3c8497c Reviewed-on: https://go-review.googlesource.com/129684 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-07-19cmd/go/internal/modfetch: move to new pseudo-version designRuss Cox
The original pseudo-version design used versions of the form v0.0.0-yyyymmddhhmmss-abcdef123456 These were intentionally chosen to be valid semantic versions that sort below any explicitly-chosen semantic version (even v0.0.0), so that they could be used before anything was tagged but after that would essentially only be useful in replace statements (because the max operation during MVS would always prefer a tagged version). Then we changed the go command to accept hashes on the command line, so that you can say go get github.com/my/proj@abcdef and it will download and use v0.0.0-yyyymmddhhmmss-abcdef123456. If you were using v1.10.1 before and this commit is just little bit newer than that commit, calling it v0.0.0-xxx is confusing but also harmful: the go command sees the change from v1.10.1 to the v0.0.0 pseudoversion as a downgrade, and it downgrades other modules in the build. In particular if some other module has a requirement of github.com/my/proj v1.9.0 (or later), the pseudo-version appears to be before that, so go get would downgrade that module too. It might even remove it entirely, if every available version needs a post-v0.0.0 version of my/proj. This CL introduces new pseudo-version forms that can be used to slot in after the most recent explicit tag before the commit. If the most recent tagged commit before abcdef is v1.10.1, then now we will use v1.10.2-0.yyyymmddhhmmss-abcdef123456 This has the right properties for downgrades and the like, since it is after v1.10.1 but before almost any possible successor, such as v1.10.2, v1.10.2-1, or v1.10.2-pre. This CL also uses those pseudo-version forms as appropriate when mapping a hash to a pseudo-version. This fixes the downgrade problem. Overall, this CL reflects our growing recognition of pseudo-versions as being like "untagged prereleases". Issue #26150 was about documenting best practices for how to work around this kind of accidental downgrade problem with additional steps. Now there are no additional steps: the problem is avoided by default. Fixes #26150. Change-Id: I402feeccb93e8e937bafcaa26402d88572e9b14c Reviewed-on: https://go-review.googlesource.com/124515 Reviewed-by: Bryan C. Mills <bcmills@google.com>
2018-07-19cmd/go/internal/module: add new +incompatible version build annotationRuss Cox
Repos written before the introduction of semantic import versioning introduced tags like v2.0.0, v3.0.0, and so on, expecting that (1) the import path would remain unchanged, and perhaps also (2) there would be at most one copy of the package in a build. We've always accommodated these by mapping them into the v0/v1 version range, so that if you ran go get k8s.io/client-go@v8.0.0 it would not complain about v8.x.x being a non-v1 version and instead would map that version to a pseudo-version in go.mod: require k8s.io/client-go v0.0.0-20180628043050-7d04d0e2a0a1 The pseudo-version fails to capture two important facts: first, that this really is the v8.0.0 tag, and second, that it should be preferred over any earlier v1 tags. A related problem is that running "go get k8s.io/client-go" with no version will choose the latest v1 tag (v1.5.1), which is obsolete. This CL introduces a new version suffix +incompatible that indicates that the tag should be considered an (incompatible) extension of the v1 version sequence instead of part of its own major version with its own versioned module path. The requirement above can now be written: require k8s.io/client-go v8.0.0+incompatible (The +metadata suffix is a standard part of semantic versioning, and that suffix is ignored when comparing two versions for precedence or equality. As part of canonicalizing versions recorded in go.mod, the go command has always stripped all such suffixes. It still strips nearly all: only +incompatible is preserved now.) In addition to recognizing the +incompatible, the code that maps a commit hash to a version will use that form when appropriate, so that go get k8s.io/client-go@7d04d0 will choose k8s.io/client-go@v8.0.0+incompatible. Also, the code that computes the list of available versions from a given source code repository also maps old tags to +incompatible versions, for any tagged commit in which a go.mod file does not exist. Therefore go list -m -versions k8s.io/client-go@latest will show k8s.io/client-go v1.4.0 v1.5.0 v1.5.1 v2.0.0-alpha.0+incompatible ... v8.0.0+incompatible and similarly go get k8s.io/client-go will now choose v8.0.0+incompatible as the meaning of "latest tagged version". The extraction of +incompatible versions from source code repos depends on a codehost.Repo method ReadFileRevs, to do a bulk read of multiple revisions of a file. That method is only implemented for git in this CL. Future CLs will need to add support for that method to the other repository implementations. Documentation for this change is in CL 124515. Fixes #26238. Change-Id: I5bb1d7a46b5fffde34a3c0e6f8d19d9608188cea Reviewed-on: https://go-review.googlesource.com/124384 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-07-12cmd/go: merge module support from x/vgo repoRuss Cox
This CL corresponds to CL 123361, the final manual CL in that repo, making this the final manual sync. All future commits will happen in this repo (the main Go repo), and we'll update x/vgo automatically with a fixed patch+script. Change-Id: I572243309c1809727604fd704705a23c30e85d1a Reviewed-on: https://go-review.googlesource.com/123576 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2018-06-15cmd/go: add dark copy of golang.org/x/vgoRuss Cox
This CL corresponds to golang.org/cl/118096 (7fbc8df48a7) in the vgo repo. It copies the bulk of the code from vgo back into the main repo, but completely disabled - vgo.Init is a no-op and vgo.Enabled returns false unconditionally. The point of this CL is to make the two trees easier to diff and to make future syncs smaller. Change-Id: Ic34fd5ddd8272a70c5a3b3437b5169e967d0ed03 Reviewed-on: https://go-review.googlesource.com/118095 Reviewed-by: Bryan C. Mills <bcmills@google.com>