cmd/go/internal/modload: do not resolve an arbitrary version for 'go …

…list --versions'

If we don't actually require the listed module, we previously
implicitly resolved "latest", but also (erroneously) forgot to apply
exclusions and retractions for it. But there is really no need to
resolve "latest" in this case at all — now we omit the version from
the reported module info entirely.

Fixes #44296

Change-Id: Id595f52f597c7213bd65b73bf066a678d9e1d694
Reviewed-on: https://go-review.googlesource.com/c/go/+/297150
Trust: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

src/cmd/go/internal/modload/build.go

@@ -113,7 +113,11 @@ func addVersions(ctx context.Context, m *modinfo.ModulePublic, listRetracted boo
 	if listRetracted {
 		allowed = CheckExclusions
 	}
-	m.Versions, _ = versions(ctx, m.Path, allowed)
+	var err error
+	m.Versions, err = versions(ctx, m.Path, allowed)
+	if err != nil && m.Error == nil {
+		m.Error = &modinfo.ModuleError{Err: err.Error()}
+	}
 }
 
 // addRetraction fills in m.Retracted if the module was retracted by its author.

src/cmd/go/internal/modload/list.go

@@ -136,17 +136,9 @@ func listModules(ctx context.Context, args []string, listVersions, listRetracted
 				if listVersions {
 					// Don't make the user provide an explicit '@latest' when they're
 					// explicitly asking what the available versions are.
-					// Instead, resolve the module, even if it isn't an existing dependency.
-					info, err := Query(ctx, arg, "latest", "", nil)
-					if err == nil {
-						mod := moduleInfo(ctx, module.Version{Path: arg, Version: info.Version}, false, listRetracted)
-						mods = append(mods, mod)
-					} else {
-						mods = append(mods, &modinfo.ModulePublic{
-							Path:  arg,
-							Error: modinfoError(arg, "", err),
-						})
-					}
+					// Instead, return a modinfo without a version,
+					// to which we can attach the requested version list.
+					mods = append(mods, &modinfo.ModulePublic{Path: arg})
 					continue
 				}
 				if cfg.BuildMod == "vendor" {

src/cmd/go/testdata/script/mod_proxy_https.txt

@@ -10,6 +10,7 @@ stderr 'invalid proxy URL.*proxydir'
 # GOPROXY HTTPS paths may elide the "https://" prefix.
 # (See golang.org/issue/32191.)
 env GOPROXY=proxy.golang.org
+env GOSUMDB=
 go list -versions -m golang.org/x/text
 
 -- go.mod --

src/cmd/go/testdata/script/mod_retract_versions.txt

@@ -10,9 +10,8 @@ go list -m -e -f $FMT example.com/retract/self/pseudo@latest
 stdout '^example.com/retract/self/pseudo: "module example.com/retract/self/pseudo: no matching versions for query \\"latest\\"" "latest"$'
 
 
-	# BUG(#44296): Adding --versions should not cause a retracted version to be reported.
 go list -m -e -f $FMT --versions example.com/retract/self/pseudo
-stdout '^example.com/retract/self/pseudo "v1.9.0"$'
+stdout '^example.com/retract/self/pseudo ""$'
 
 go list -m -e -f $FMT --versions example.com/retract/self/pseudo@latest
 stdout '^example.com/retract/self/pseudo: "module example.com/retract/self/pseudo: no matching versions for query \\"latest\\"" "latest"$'