proxy.golang.org: serve status 404/410 instead of 400 for versions that fail validation

[integrii]

What version of Go are you using (go version)?

go version go1.13beta1 darwin/amd64

Does this issue reproduce with the latest release?

The latest RC, yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN="/Users/egreer200/go/bin"
GOCACHE="/Users/egreer200/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/egreer200/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/Cellar/go/1.12.7/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.12.7/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/egreer200/git/cluster-federation/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/7h/qd9xrbq10lb03g4lkqcl_cdr0000gp/T/go-build275189146=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

I attempted to build a project with the following module:

module github.comcast.com/tpCloudOps/cluster-federation

go 1.13

require github.com/bcmills/k8s-mods v1.13.3 // indirect

You can include this module easily with go build -d github.com/bcmills/k8s-mods.

What did you expect to see?

A build to be produced. This module builds fine on go version go1.12.7 darwin/amd64.

What did you see instead?

go get: github.com/bcmills/[email protected] requires
	k8s.io/[email protected]+incompatible: reading https://proxy.golang.org/k8s.io/client-go/@v/v2.0.0-alpha.0.0.20190202011228-6e4752048fde+incompatible.mod: 400 Bad Request

[heschi]

@bcmills: looks like you have an invalid pseudoversion in there?

The error reporting is currently better for direct mode (see #30748):

$ GOPROXY=direct go1.13beta1 get -d github.com/bcmills/k8s-mods
go get: github.com/bcmills/[email protected] requires
        k8s.io/[email protected]+incompatible: invalid pseudo-version: preceding tag (v2.0.0-alpha.0) not found

[integrii]

I agree that there may be bad versions upstream and all that, but go 1.12 works properly - this bug is to generically to declare that "something got worse". This used to work, and now it does not.

[heschi]

I should have said: this is intended new behavior in Go 1.13. See "Version Validation" in https://tip.golang.org/doc/go1.13. Sorry for the trouble; these were serious bugs that had to be fixed despite the incompatibility.

[bcmills]

looks like you have an invalid pseudoversion in there?

Indeed. I think k8s.io/client-go removed a v2.0.0-alpha.0 tag at some point. (I've seen that failure mode in a previous issue report.) Probably I should add a README deprecating my workaround repo now that k8s.io has a proper module for client-go.

[bcmills]

Note that the proxy could trigger the better direct failure messages today by serving 410 or 404 responses instead of 400s.

(I thought we had an issue filed for that, but I can't find it right now.)

[katiehockman]

@bcmills if a client is asking for an invalid version, then wouldn't 400 be the right status code? Or are you just suggesting that there be a better error message?

[bcmills]

@katiehockman, a version that is invalid from the perspective of the proxy — in particular, invalid from the perspective of the version of the go command that the proxy uses — is not necessarily invalid from the perspective of the user's go command. (Versions that are invalid in go1.13 could potentially become valid in go1.14, if we discover some change that needs to happen, and that should not prevent users on 1.14 pre-releases from fetching those versions.)

[katiehockman]

Okay, thanks. So the 404/410 is important for the purposes of fallback to direct.

[hyangah]

Fix rollout is complete. This should be fixed by now.

$ curl -i https://proxy.golang.org/k8s.io/client-go/@v/v2.0.0-alpha.0.0.20190202011228-6e4752048fde+incompatible.mod
HTTP/1.1 410 Gone
...