cmd/go: get doesn't select dependencies limited to go@version

[alexander-bachmann]

Go version

go version go1.21.8 darwin/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/Users/aoeu/Library/Caches/go-build'
GOENV='/Users/aoeu/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/aoeu/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/aoeu/go'
GOPRIVATE=''
GOPROXY=''
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_amd64'
GOVCS=''
GOVERSION='go1.21.8'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='1'
GOMOD='/Users/aoeu/Desktop/just-a-test/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/sm/14wxd09941l27xkmt31qrz3h0000gq/T/go-build2401627713=/tmp/go-build -gno-record-gcc-switches -fno-common'

What did you do?

we would like to stay on golang version 1.21 and still be able to update our dependencies using go get -u ./...

the problem is that go get doesn’t respect the local toolchain version and attempts to pull in module versions that are newer than the local toolchain

we found this solution #59886 (comment) but it doesn’t seem to work as seen in the example below:

% go version
go version go1.21.8 darwin/amd64

% export GOTOOLCHAIN=local

% go get k8s.io/client-go go@1.21.8
go: k8s.io/client-go@v0.30.1 requires go >= 1.22.0 (running go 1.21.8; GOTOOLCHAIN=local)

I also attempted with go get k8s.io/client-go go@1.21 and go get k8s.io/client-go go@1.20

What did you see happen?

not download compatible module version

What did you expect to see?

download compatible module version

[seankhliao]

cc @matloob @samthanawalla @hyangah

[thediveo]

the current behavior also breaks tools like go-mod-upgrade completely that use go get.

[matloob]

I can reproduce this. We should fix it. I'm not totally sure if it justifies getting in after the freeze or to be backported, but it might?