cmd/go/internal/modfetch: avoid using non-canonical semver tags

We insist that semver tags in repos be fully spelled out,
as required by semver: v1.2.0, not v1.2. In other places,
like go.mod, we do allow saying v1.2 as shorthand for v1.2.0.
Don't confuse the issue by reporting a "v1.2" tag in the
version list, since it's unaddressable. (If you type v1.2 vgo will
look for v1.2.0.)

Similarly, don't report tags that don't match the module path,
and don't report tags that look like pseudo-versions.

Additional fix for golang/go#23954, golang/go#24476.

Change-Id: Iaac0fb36362b25e5faef5271c110d432ec04bc8b
Reviewed-on: https://go-review.googlesource.com/107659
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>

vendor/cmd/go/internal/modfetch/coderepo.go

@@ -79,7 +79,7 @@ func (r *codeRepo) Versions(prefix string) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	var list []string
+	list := []string{}
 	for _, tag := range tags {
 		if !strings.HasPrefix(tag, p) {
 			continue
@@ -88,11 +88,7 @@ func (r *codeRepo) Versions(prefix string) ([]string, error) {
 		if r.codeDir != "" {
 			v = v[len(r.codeDir)+1:]
 		}
-		// Only accept canonical semver tags from the repo. (See #24476.)
-		if v != semver.Canonical(v) {
-			continue
-		}
-		if !module.MatchPathMajor(v, r.pathMajor) {
+		if !semver.IsValid(v) || v != semver.Canonical(v) || isPseudoVersion(v) || !module.MatchPathMajor(v, r.pathMajor) {
 			continue
 		}
 		list = append(list, v)

vendor/cmd/go/internal/modfetch/coderepo_test.go

@@ -505,6 +505,10 @@ var codeRepoVersionsTests = []struct {
 		path:     "gopkg.in/russross/blackfriday.v2",
 		versions: []string{"v1.0.0-gopkgin-v2.0.0"},
 	},
+	{
+		path:     "gopkg.in/natefinch/lumberjack.v2",
+		versions: []string{},
+	},
 }
 
 func TestCodeRepoVersions(t *testing.T) {