cmd/go: incompatible module version not detected by 'go run' or 'go build'

[carnott-snap]

What version of Go are you using (go version)?

[user@localhost ~]$ go version
go version go1.13 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

[user@localhost ~]$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/user/.cache/go-build"
GOENV="/home/user/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY="*.sc-corp.net"
GONOSUMDB="*.sc-corp.net"
GOOS="linux"
GOPATH="/home/user/go"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/home/user/.local/share/umake/go/go-lang"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/user/.local/share/umake/go/go-lang/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/tmp/test/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build698062687=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Create the following go.mod file:

module test
  
go 1.13

require k8s.io/client-go v12.0.0+incompatible

Create the following main.go file:

package main
  
import (
        "fmt"

        "k8s.io/client-go/pkg/version"
)

func main() { fmt.Println(version.Get()) }

What did you expect to see?

The toolchain should fail all interactions with k8s.io/client-go because of the combination of the go.mod file at the v12.0.0 tag:

[user@localhost test]$ go get k8s.io/client-go@v12.0.0
go: finding k8s.io v12.0.0
go: finding k8s.io/client-go v12.0.0
go: finding k8s.io/client-go v12.0.0
go get k8s.io/client-go@v12.0.0: k8s.io/client-go@v12.0.0: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v12
[user@localhost test]$ go run .
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
go list -m: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required
[user@localhost test]$ go build
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
go list -m: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required
[user@localhost test]$ go doc k8s.io/client-go/pkg/version
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
go list -m: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required

What did you see instead?

All parts of the toolchain I tested appear to re-find the problematic module on every invocation, however go get fails (as above), go doc warns, and both go run and go build succeed:

[user@localhost test]$ go run .
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
v0.0.0-master+$Format:%h$
[user@localhost test]$ go build
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
[user@localhost test]$ ./test 
v0.0.0-master+$Format:%h$
[user@localhost test]$ go doc k8s.io/client-go/pkg/version
go: finding k8s.io/client-go v12.0.0+incompatible
go: finding k8s.io/client-go v12.0.0+incompatible
go list -m: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required
package version // import "k8s.io/client-go/pkg/version"

Package version supplies version information collected at build time to
kubernetes components.

func Get() apimachineryversion.Info

[toothrot]

I am not sure if this is a bug in build or doc. /cc @bcmills @jayconrod who know more about the nuances here.

[bcmills]

Thanks for the report. I can reproduce the described behavior starting from a clean module cache, and this is indeed a bug in go run / go build.

[carnott-snap]

With the recent changes in 1.16 the failure is not reproducable through the suggestions and default flow:

[user@localhost trash]$ go run .
go: k8s.io/client-go@v12.0.0+incompatible: missing go.sum entry; to add it:
        go mod download k8s.io/client-go
[user@localhost trash]$ go mod download k8s.io/client-go
go mod download: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required

But the go get is only a warning, so (starting from a clean state) it still reproduces:

[user@localhost trash]$ go mod download
go mod download: k8s.io/client-go@v12.0.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required
[user@localhost trash]$ go get k8s.io/client-go@v12.0.0
go get: k8s.io/client-go@v12.0.0: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v12
[user@localhost trash]$ go run .
main.go:6:2: missing go.sum entry for module providing package k8s.io/client-go/pkg/version (imported by test); to add:
        go get test
[user@localhost trash]$ go get test
go: downloading k8s.io/client-go v12.0.0+incompatible
go: downloading k8s.io/apimachinery v0.0.0-20190612205821-1799e75a0719
go: warning: k8s.io/client-go@v12.0.0+incompatible: retracted by module author: pre-module versions are obsolete
go: to switch to the latest unretracted version, run:
        go get k8s.io/client-go@latest
[user@localhost trash]$ go run .
v0.0.0-master+$Format:%h$

[bcmills]

Thanks for the updated steps to reproduce. I'll see if I can get to this for 1.17 once the lazy-loading changes are done.

[ianlancetaylor]

@bcmills Is this likely to happen for 1.18? Thanks.

[bcmills]

Sadly no.

(Changes to version validation tend to catch existing broken modules, so they shouldn't happen during the freeze.)

[gopherbot]

This issue is currently labeled as early-in-cycle for Go 1.21.
That time is now, so a friendly reminder to look at it again.

[gopherbot]

This issue is currently labeled as early-in-cycle for Go 1.22.
That time is now, so a friendly reminder to look at it again.