cmd/go: module loading should not silently replace nonexistent versions with valid ones

[andig]

What version of Go are you using (go version)?

go version go1.12.3 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
❯ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/andig/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/andig/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/Cellar/go/1.12.3/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.12.3/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/andig/htdocs/tf/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/73/89ycv7qn51j4kbm04jsz9b840000gn/T/go-build752630872=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Trying to require a specific branch:

go mod init tf
go mod edit -require github.com/containous/alice@containous-fork
go mod edit -require github.com/containous/traefik@master

What did you expect to see?

Dependencies added to go.mod

What did you see instead?

Error:

go: errors parsing go.mod:
/Users/andig/htdocs/tf/go.mod:5: invalid module version "containous-fork": version must be of the form v1.2.3

for this go.mod:

module tf

go 1.12

require github.com/containous/alice containous-fork

If the branch for is invalid it should probably not be allowed to add it using go mod edit. Because doing so will silently override the dependency when doing a go run instead of the 2nd go mod edit which is highly non-obvious.

[bcmills]

go mod edit is not supposed to do any semantic validation at all: its specific purpose is to edit the go.mod file without ensuring consistency. (Contrast #30513 and #28439.)

If you want to add a specific version of a dependency, the command to use for that is go get.

[bcmills]

Was there a specific piece of documentation that led you to go mod edit? If so, perhaps we can make that documentation clearer; otherwise, this seems to be working as designed.

[andig]

Was there a specific piece of documentation that led you to go mod edit?

None really, just SO.

But as for the second point, even if go mod is wrong- should go run silently override the requirement (or does it only do so for invalid entries)?

[bcmills]

In general all of the go subcommands do resolve missing dependencies, and they upgrade modules as necessary to satisfy packages that are not present in the selected version.

On the other hand, if the existing version was completely invalid (not just too early to satisfy the necessary imports, we should probably diagnose that explicitly rather than silently “upgrading” from the invalid version to a valid one.

[bcmills]

(CC @jayconrod for cmd/go diagnostics)

[andig]

Closing this one as no longer a priority. Thanks for your support.