cmd/go: issuing mod edit -retract allows bad version format

[nomad-software]

What version of Go are you using (go version)?

v1.16 beta1

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/tmp/go-cache"
GOENV="/home/gary/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/tmp/go-mod-cache"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/media/Data/Projects/Go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/opt/go"
GOSUMDB="sum.golang.org"
GOTMPDIR="/tmp"
GOTOOLDIR="/opt/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16beta1"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/media/Data/Projects/Go/src/github.com/nomad-software/vend/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build631806544=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Changed directory to my project and issued the following commands

go mod edit -retract 1.0.0
go mod edit -json

Then received the following error.

go: errors parsing go.mod:
/media/Data/Projects/Go/src/github.com/nomad-software/vend/go.mod:5: retract: version "1.0.0" invalid: must be of the form v1.2.3

What did you expect to see?

Issuing the command go mod edit -retract 1.0.0 should have warned me the version format was wrong.

What did you see instead?

version "1.0.0" invalid: must be of the form v1.2.3

[cagedmantis]

/cc @bcmills @jayconrod @matloob

[bcmills]

In general go mod edit would benefit from a lot more validation than it has today (see also #32630, #28439, and others). It would be nice if we can fix this before the 1.16 release, but I don't think it's absolutely critical.

[jayconrod]

Should go mod edit only allow canonical semantic versions for require, replace, and exclude as well? In 1.15 you can use branch or tag names for any version. The next module aware command will change those to canonical versions. That will be a lot less useful in 1.16 with -mod=readonly though, and for scripting, it's probably a better idea to resolve non-canonical versions with go list -m first.

[bcmills]

For require, at least, go mod edit followed by go mod tidy should be a decent option for scripting — but I would not expect go mod tidy to change retract directives in any way.

So I think we should continue to accept non-canonical versions for at least require and replace, but reject them for retract.

[tzierbock]

It appears this would be a simple case of adding validation of the input versions to File.AddRetract? If that is indeed the case I can come up with a CL for that. Would the same make sense for File.AddExclude?

[bcmills]

Yep, the AddRetract function sounds like the right place.

I'm not sure whether we should reject non-canonical versions for exclude directives. Could you check whether they are rewritten to canonical versions today?

[tzierbock]

By testing go mod edit -exclude with a similar version string it appears it causes the same behaviour, not complaining when adding the exclude statement and then producing an error on subsequent runs of go mod tidy or go mod edit -json

[bcmills]

Thanks. Then we should probably validate in AddExclude too.

[gopherbot]

Change https://golang.org/cl/279394 mentions this issue: cmd/go: validating version format in mod edit

[gopherbot]

Change https://golang.org/cl/283853 mentions this issue: cmd/go: in 'go mod edit', validate versions given to -retract and -exclude