Go modules auto-downloading to wrong commit after retagging

[jrcasso]

What version of Go are you using (go version)?

$ go version
go version go1.15.3 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/workspaces/omitted/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build267860181=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I created a module in Github, and erroneously tagged the wrong commit. I imported the module. Upon realizing the mistake, I then force-pushed over that tag to refer to a new commit. The Go module auto-download of the remote Github module still used the old tag's reference, even when the module was removed and reinstalled. The new tag's reference was not picked up, and I had to skip a version number to accommodate the change.

What did you expect to see?

Go modules auto-download should have pulled down the new commit for the given semantically versioned tag.

What did you see instead?

Go modules auto-downloaded the old tag that referred to a previous commit.

[seankhliao]

you cannot move tags, right now you are getting the cached version but if you ever get the version from source it will complain about mismatched checksums

tag a new higher version and move on

[bcmills]

This is working as designed. The meaning of a version must be consistent over time, so you cannot reuse or repurpose existing tags with Go modules. However, as of Go 1.16 you will be able to retract unintended versions. (See https://tip.golang.org/doc/go1.16#go-command and #24031.)

[jrcasso]

Yeah, that totally makes sense; thanks for the quick response. That retract feature will be pretty sweet!