cmd/go: go list -m --versions behaves differently with retracted versions depending on the presence of @latest

[hyangah]

go version: 1.16rc1

$ cat go.mod
module f

go 1.16

The contents of go.mod don't change. I emptied the module cache before each command below.
The module I am querying here has v1.0.0 and v1.0.1, and both were retracted.

$ GOPROXY=direct GOSUMDB=off go  list -m -json  github.com/hyangah/retracttest/a
go list -m: module github.com/hyangah/retracttest/a: not a known dependency

vs.

$ GOPROXY=direct GOSUMDB=off go  list -m -json  github.com/hyangah/retracttest/a@latest
{
        "Path": "github.com/hyangah/retracttest/a",
        "Version": "v0.0.0-20201117044135-c0d2dc84e45f",
        "Time": "2020-11-17T04:41:35Z",
        "GoVersion": "1.15"
}

With --versions:

$ GOPROXY=direct GOSUMDB=off go  list -m -json --versions github.com/hyangah/retracttest/a
{
        "Path": "github.com/hyangah/retracttest/a",
        "Version": "v1.0.1",
        "Time": "2020-11-16T22:37:32Z",
        "GoVersion": "1.15"
}

vs.

$ GOPROXY=direct GOSUMDB=off go  list -m -json --versions github.com/hyangah/retracttest/a@latest
{
        "Path": "github.com/hyangah/retracttest/a",
        "Version": "v0.0.0-20201117044135-c0d2dc84e45f",
        "Time": "2020-11-17T04:41:35Z",
        "GoVersion": "1.15"
}

cc @jayconrod

[hyangah]

The first case is WAI according to @bcmills because the main module doesn't have the dependency.
The second case is also WAI because it's querying the origin.

[bcmills]

The @latest results look correct to me. The second --versions result (returning v1.0.1 may or may not be correct, depending on the initial conditions. (If v1.0.1 was already selected, then it would be correct, but if v1.0.1 was not already selected then it should not have been resolved.)

[bcmills]

I can reproduce the --versions behavior in a clean module, so that's almost certainly a bug.

[bcmills]

I happened to be poking around in the list implementation for lazy loading today, and noticed this codepath:

go/src/cmd/go/internal/modload/list.go

Lines 134 to 151 in 0e85fd7

	if !matched {
	if literal {
	if listVersions {
	// Don't make the user provide an explicit '@latest' when they're
	// explicitly asking what the available versions are.
	// Instead, resolve the module, even if it isn't an existing dependency.
	info, err := Query(ctx, arg, "latest", "", nil)
	if err == nil {
	mod := moduleInfo(ctx, module.Version{Path: arg, Version: info.Version}, false, listRetracted)
	mods = append(mods, mod)
	} else {
	mods = append(mods, &modinfo.ModulePublic{
	Path: arg,
	Error: modinfoError(arg, "", err),
	})
	}
	continue
	}

I think that extra call to Query for listVersions is just wrong. I'm going to fix this so that I don't have to port the wrongness forward for lazy loading. 😁

[gopherbot]

Change https://golang.org/cl/297150 mentions this issue: cmd/go/internal/modload: do not resolve an arbitrary version for 'go list --versions'

[gopherbot]

Change https://golang.org/cl/297149 mentions this issue: cmd/go: add a test case that reproduces #44296

[gopherbot]

Change https://golang.org/cl/298649 mentions this issue: [dev.go2go] all: merge master (12bb256) into dev.go2go

[gopherbot]

Change https://golang.org/cl/318850 mentions this issue: [dev.typeparams] all: merge master (9b84814) into dev.typeparams

[gopherbot]

Change https://golang.org/cl/318989 mentions this issue: [dev.fuzz] all: merge master (9b84814) into dev.fuzz

[gopherbot]

Change https://golang.org/cl/319749 mentions this issue: [dev.fuzz] all: merge master (2a61b3c) into dev.fuzz

[gopherbot]

Change https://golang.org/cl/319890 mentions this issue: [dev.fuzz] all: merge master (7a7624a) into dev.fuzz

[gopherbot]

Change https://golang.org/cl/320050 mentions this issue: [dev.fuzz] all: merge master (d137b74) into dev.fuzz

[gopherbot]

Change https://golang.org/cl/333013 mentions this issue: [dev.cmdgo] all: merge master (912f075) into dev.cmdgo