sum.golang.org: improve pseudo version regexp

[oiooj]

link: https://sum.golang.org/lookup/github.com/xgfone/gconf@v3.3.0+incompatible

What did you expect to see?

something like this:

1328
github.com/xgfone/gconf v3.3.0+incompatible h1:Ka0ssV/5iMMf1YgQPR0lQGa6Yp6+e2Y8/P/jOgviCCk=
github.com/xgfone/gconf v3.3.0+incompatible/go.mod h1:v3VqEuUnjlVYVQxIhAobyFZ+8zEJWVEYfmNFaU8On6c=

go.sum database tree
1329
qX5FDdJtUuayYdFSjQNHTxXBFA/6ZV64g5EymKOCmHk=

— gosum.io zm51ZfEc2ervwLzyS4S1H6ext1+8+jcNx0fX8FJHqVDI0cpXHc4pGUwKEbfF/XLZCLvNvbm16RWWc9/wNuIF9CtuAw8=

What did you see instead?

not found: github.com/xgfone/gconf@v3.3.0+incompatible: invalid version: +incompatible suffix not allowed: module contains a go.mod file, so semantic import versioning is required

/cc @hyangah

[bcmills]

The error message here is correct: the repository at github.com/xgfone/gconf at version v3.3.0 includes a go.mod file, so it cannot be used as version v3.3.0 of a module path that lacks a /v3 suffix.

(This is the error message that results from the fix for #32695.)

[bcmills]

As far as I can tell this is the fix to #32695 working as designed. Is there a specific detail that led you to expect different behavior from the checksum database? (We don't in general provide checksums for modules that cannot be retrieved using go mod download.)

[oiooj]

Thanks @bcmills .

[xgfone]

I have met with this trouble after updating the go version from 1.12.7 to 1.13.0.

I have a project, and go.mod is like this.

module ipdb

require (
	github.com/xgfone/gconf v3.7.0+incompatible
	github.com/xgfone/klog v1.10.0
	github.com/xgfone/ship v1.8.0
)

But there is no go.sum, which will be created automatically when running go mod tidy.

When using go 1.12.7, it's ok.

$ go version
go version go1.12.7 windows/amd64
$ ls go.*
go.mod
$ go mod tidy
$ ls go.*
go.mod  go.sum

For go 1.13.0, however, it didn't work. For instance,

$ go version
go version go1.13 windows/amd64

$ ls go.*
go.mod

$ GOPROXY=https://goproxy.io,direct go mod tidy
verifying github.com/xgfone/gconf@v3.7.0+incompatible/go.mod: github.com/xgfone/gconf@v3.7.0+incompatible/go.mod: malformed record data

$ GOPROXY=https://goproxy.cn,direct go mod tidy
verifying github.com/xgfone/gconf@v3.7.0+incompatible/go.mod: github.com/xgfone/gconf@v3.7.0+incompatible/go.mod: reading https://goproxy.cn/sumdb/sum.golang.org/lookup/github.com/xgfone/gconf@v3.7.0+incompatible: 404 Not Found

Then, I ran go mod tidy with GONOSUMDB="*", and it will create go.sum.

$ go version
go version go1.13 windows/amd64
$ GONOSUMDB="*" GOPROXY=https://goproxy.io go mod tidy
$ echo $?
0
$ ls go.*
go.mod  go.sum

Last, I ran go mod tidy again without GONOSUMDB, it's ok, too. That's, When no go.sum, it will report an error; or, it's ok.

$ ls go.*
go.mod  go.sum
$ GOPROXY=https://goproxy.io,direct go mod tidy
$ echo $?
0

31543 says:

Given time before 1.13 is short, I suggest aiming for some cheap but useful improvements.

I agree with that.

@oiooj How had I better do?

1. Disable SUM DB, like GONOSUMDB="*" above. But not everyone will disable it.
2. Modify go.mod in github.com/xgfone/gconf and declare the module from github.com/xgfone/gconf to github.com/xgfone/gconf/v3. But it maybe break down some existed projects.
3. Others...

[hyangah]

I am guessing the checksum verification occurs only when the module is downloaded from the Internet to the module cache for the first time. So, once it lands in the local disk (by skipping the sumdb check), go command simply accepts it if the checksum in go.sum and the checksum of the copy in the cache matches.

@xgfone Is it not an option to release the latest version that follows the import versioning rule and ask users to pick the new version with the same import path? Currently go command recognizes up to v1.5.0 in the repo. Maybe v1.6.0 assuming there were not backward-incompatible changes.

GO111MODULE=on GOPROXY=direct go list -m -json --versions github.com/xgfone/gconf
{
	"Path": "github.com/xgfone/gconf",
	"Version": "v1.5.0",
	"Versions": [
		"v1.0.0",
		"v1.0.1",
		"v1.2.0",
		"v1.2.1",
		"v1.3.0",
		"v1.4.0",
		"v1.5.0"
	],
	"Time": "2019-04-24T08:12:22Z"
}

Or if your intention was to stick with v3, yes, I am sorry it needs to fix go.mod to use github.com/xgfone/gconf/v3 (like your option 2) and ask users to switch their import paths or use replace.

BTW it's strange to see go mod tidy accept the invalid incompatible version that other go commands would reject and I think that's a bug. I will file an issue to track the bug separately.

[xgfone]

@hyangah Yes, you are right. Tks.

It may be better to declare the module from github.com/xgfone/gconf to github.com/xgfone/gconf/v3 and to replace github.com/xgfone/gconf with github.com/xgfone/gconf/v3. The user only needs to add one replace for the existed project, just like repalce github.com/xgfone/gconf => github.com/xgfone/gconf/v3 3.X.0