Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions #32662

Closed
marwan-at-work opened this issue Jun 17, 2019 · 4 comments
Closed
Assignees
Milestone

Comments

@marwan-at-work
Copy link
Contributor

@marwan-at-work marwan-at-work commented Jun 17, 2019

Go version: Go 1.12.6

The following command fails:

GOPROXY=https://proxy.golang.org GOPATH=/tempdir go install github.com/golangci/golangci-lint/cmd/golangci-lint

The failure error comes out to be:

build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

It turns out that golangci-lint's go.mod file has an incorrect timestamps in the pseudo-semver version: v0.0.0-20181204210945-1df300866540 because they updated the go.mod file manually which seems to be here (golangci/golangci-lint@7274db7#diff-37aff102a57d3d7b797f152915a6dc16R8)

If you run:

curl https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info

You get

{"Version":"v0.0.0-20190526074819-1df300866540","Time":"2019-05-26T00:48:19-07:00"}

Notice that the timestamp here is 20190526074819 while the golangci's go.mod file is 20181204210945. See here: https://github.com/golangci/golangci-lint/blob/master/go.mod#L8

Since the .info endpoint succeeds and returns a different version, I'm surprised that the Go command did not pick up the new version for the following .zip call. Is this the expected behavior?

Interestingly enough, go mod download doesn't care about the timestamp, and since it's the recommended tool to use, GOPROXY=off and GOPROXY=<athens> succeed but proxy.golang.org fails.

cc: @fsouza

@heschik heschik self-assigned this Jun 17, 2019
@heschik

This comment has been minimized.

Copy link
Contributor

@heschik heschik commented Jun 17, 2019

Thanks for the excellent report. This looks like a bug in the go command to me:

$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
go: finding github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20190526074819-1df300866540.mod
go: downloading github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip
build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

Note that it uses the canonicalized pseudoversion to download the .mod, but not the .zip. I'd like to hear an opinion from @bcmills @jayconrod on what's going on here. I think we may have to support these kinds of requests in proxy.golang.org though.

@dmitshur dmitshur added this to the Unreleased milestone Jun 17, 2019
@bcmills

This comment has been minimized.

Copy link
Member

@bcmills bcmills commented Jun 17, 2019

This is closely related to #27173. I'm still investigating how frequent these are in practice.

With the current draft of CL 181881, I get a more consistent failure using the proxy:

example.com$ go mod init example.com
go: creating new go.mod: module example.com

example.com$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request (0.119s)
        github.com/go-critic/go-critic@v0.0.0-20181204210945-1df300866540: reading https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request
@bcmills

This comment has been minimized.

Copy link
Member

@bcmills bcmills commented Jun 17, 2019

Note specifically the fixes to (*modfetch.codeRepo).GoMod and (*modfetch.codeRepo).Zip in that CL.

@bcmills bcmills changed the title proxy.golang.org: inconsistent behavior on incorrect timestamps cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions Jun 17, 2019
@gopherbot

This comment has been minimized.

Copy link

@gopherbot gopherbot commented Jun 18, 2019

Change https://golang.org/cl/181881 mentions this issue: cmd/go: validate pseudo-versions against module paths and revision metadata

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.