Go: cmd/go: 'malformed record data' for goproxy.io sumdb proxy response when version is invalid

[DingKingTim]

What version of Go are you using (go version)?

$ go version
go version go1.13 darwin/amd64

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

go env Output

$ go env

GO111MODULE="on"

GOARCH="amd64"

GOBIN=""

GOCACHE="/Users/dk/Library/Caches/go-build"

GOENV="/Users/dk/Library/Application Support/go/env"

GOEXE=""

GOFLAGS=""

GOHOSTARCH="amd64"

GOHOSTOS="darwin"

GONOPROXY=""

GONOSUMDB=""

GOOS="darwin"

GOPATH="/Users/dk/Public/go"

GOPRIVATE=""

GOPROXY="https://goproxy.io"

GOROOT="/usr/local/go"

GOSUMDB="sum.golang.org"

GOTMPDIR=""

GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"

GCCGO="gccgo"

AR="ar"

CC="clang"

CXX="clang++"

CGO_ENABLED="1"

GOMOD="/Users/dk/github/lacr_admin/go.mod"

CGO_CFLAGS="-g -O2"

CGO_CPPFLAGS=""

CGO_CXXFLAGS="-g -O2"

CGO_FFLAGS="-g -O2"

CGO_LDFLAGS="-g -O2"

PKG_CONFIG="pkg-config"

GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/8t/6_sy1kb90gscgqgj67fdrjbw0000gn/T/go-build067542338=/tmp/go-build -gno-record-gcc-switches -fno-common"

I got error when I was testing micro example(https://github.com/micro/examples/tree/master/config/grpc/srv). it report:

verifying github.com/gogo/[email protected]/go.mod: github.com/gogo/[email protected]/go.mod: malformed record data

[agnivade]

Please mention the exact steps that you performed so that we can reproduce this.

[DingKingTim]

steps that I performed（Before to do the flowing step I executed go clean -modcache）:

$ git clone https://github.com/micro/examples.git
$ cd examples/config
$ go mod init config
$ go mod tidy
verifying github.com/gogo/[email protected]/go.mod: github.com/gogo/[email protected]/go.mod: malformed record data

[tmthrgd]

The pseudo version is wrong, if you visit https://sum.golang.org/lookup/github.com/gogo/[email protected] you'll see:

not found: github.com/gogo/[email protected]: invalid pseudo-version: revision is shorter than canonical (65acae22fc9d)

The correct pseudo-version is actually v0.0.0-20190723190241-65acae22fc9d, and you'll see the sum.golang.org lookup for that succeeds.

When I repeat your commands locally using the official Go proxy (proxy.golang.org) instead of goproxy.io, a clearer failure occurs earlier in go mod tidy:

$ go mod tidy
go: finding github.com/micro/go-micro v1.10.0
go: finding google.golang.org/grpc v1.23.1
go: finding github.com/micro/go-plugins v1.3.0
go: downloading google.golang.org/grpc v1.23.1
go: downloading github.com/micro/go-micro v1.10.0
go: downloading github.com/micro/go-plugins v1.3.0
go: extracting google.golang.org/grpc v1.23.1
go: extracting github.com/micro/go-micro v1.10.0
go: extracting github.com/micro/go-plugins v1.3.0
go: github.com/micro/[email protected] requires
    k8s.io/[email protected] requires
    github.com/gogo/[email protected]: invalid pseudo-version: revision is shorter than canonical (65acae22fc9d)

The error message here you saw isn't ideal because goproxy.io isn't validating pseudo-versions like proxy.golang.org is.

The invalid pseudo-version has actually been fixed in k8s.io/api already with kubernetes/kubernetes#80732, but that new version has not been picked up by micro/go-plugins. There are actually three separate open issues in micro/go-plugins for this: micro/go-plugins#392, micro/go-plugins#394 and micro/go-plugins#396.

You can work around this by adding a replace directive to the go.mod file:

replace github.com/gogo/protobuf v0.0.0-20190410021324-65acae22fc9 => github.com/gogo/protobuf v0.0.0-20190723190241-65acae22fc9d

[bcmills]

@tmthrgd, thanks for investigating!

One final note: it appears that the malformed record data error observed by @DingKingTim is due to goproxy.io serving the sumdb URLs with the wrong HTTP status (200 instead of something else).

$ curl -sIL https://sum.golang.org/lookup/github.com/gogo/[email protected]
ae22fc9 | grep '^HTTP'
HTTP/2 410

$ curl -sIL https://goproxy.io/sumdb/sum.golang.org/lookup/github.com/gogo/[email protected]
190410021324-65acae22fc9 | grep '^HTTP'
HTTP/2 200

CC @oiooj

[bcmills]

The fix for this diagnostic seems to belong in goproxy.io rather than the go command, so I don't think there is anything more to be done on the Go project side — closing.

[oiooj]

goproxy.io fixed this issue, thanks.