Athens: can't get new commit, when no version tag

[weitangli]

use a no version tag, example: github.com/kataras/pio

run this when no github.com/kataras/pio in disk

# download commit: v0.0.0-20180502220154-1d218932f864
curl localhost:3000/github.com/kataras/pio/@v/v0.0.0-20180502220154-1d218932f864.info

# looking version, and will list v0.0.0-20180502220154-1d218932f864
curl localhost:3000/github.com/kataras/pio/@v/list

# actually, it has a new v0.0.0-20180511174041-a9733b5b6b83,
# so, when I do tidy on module(GO111MODULE=on go mod tidy), it can't pull this

[marpio]

Our /list endpoint returns merged results from the storage and from go list -m -versions -json.
If a module has no version (like in this case) the json structure returned by go cmd doesn't contain the Versions field which we use for the /list endpoint.

go list -m -versions -json github.com/kataras/pio       
{
        "Path": "github.com/kataras/pio",
        "Version": "v0.0.0-20180511174041-a9733b5b6b83",
        "Time": "2018-05-11T17:40:41Z",
        "Indirect": true,
        "Dir": "/home/piotr/go/pkg/mod/github.com/kataras/[email protected]",
        "GoMod": "/home/piotr/go/pkg/mod/cache/download/github.com/kataras/pio/@v/v0.0.0-20180511174041-a9733b5b6b83.mod"
}

This means /list will only give the versions from the storage - in this case the one which was requested by curl localhost:3000/github.com/kataras/pio/@v/v0.0.0-20180502220154-1d218932f864.info and not necessary the most latest one.

We could theoretically use the Version field if no tag is present but I'm not sure what side effects this would have.

[marwan-at-work]

Hmm, what does go mod tidy has anything to do with this issue? Go mod tidy, AFAIK, only removes unused modules, no?

However, what @marpio said is actually a very interesting issue. And we should potentially figure out what the logic should be. Let me explain a bit more:

when you do GOPROXY=<url> go get github.com/kataras/pio and request the latest version of a module, Go does the following:

GET <pkg>/@v/list
If Athens returns nothing, then Go tries again with this endpoint
GET <pkg>/@latest
Which then forces Athens to get the latest non-semver version.

However,

Now, Athens persisted a pseudo version. Therefore, when a new user tries (against the same Athens instance), they're never gonna get the latest version because we locked a pseudo one. In other words:

GET <pkg>/@v/list
Returns v0.0.0-commit-from-last-week
// Go skips the @latest and user does not really get the "latest"

Which then forces Athens to get the latest non-semver version rendering the user outdated. Even if you explicitly say @latest, you won't get the latest version.

Long story short, /@v/list should probably not return pseudo versions, but only if upstream is healthy because if it's not then /@latest will be guaranteed to fail.

We should approach this solution after 1.12 is released and Athens officially works with 1.12+

[marpio]

Since go 1.12 is there, I will take that.