cmd/go: allow get from PR commit

[pierrre]

What version of Go are you using (go version)?

go version go1.13rc1 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""

GOARCH="amd64"

GOBIN=""

GOCACHE="/home/pierre/.cache/go-build"

GOENV="/home/pierre/.config/go/env"

GOEXE=""

GOFLAGS=""

GOHOSTARCH="amd64"

GOHOSTOS="linux"

GONOPROXY=""

GONOSUMDB=""

GOOS="linux"

GOPATH="/home/pierre/go"

GOPRIVATE=""

GOPROXY="https://proxy.golang.org,direct"

GOROOT="/home/pierre/.gimme/versions/go1.13rc1.src"

GOSUMDB="sum.golang.org"

GOTMPDIR=""

GOTOOLDIR="/home/pierre/.gimme/versions/go1.13rc1.src/pkg/tool/linux_amd64"

GCCGO="gccgo"

AR="ar"

CC="gcc"

CXX="g++"

CGO_ENABLED="1"

GOMOD=""

CGO_CFLAGS="-g -O2"

CGO_CPPFLAGS=""

CGO_CXXFLAGS="-g -O2"

CGO_FFLAGS="-g -O2"

CGO_LDFLAGS="-g -O2"

PKG_CONFIG="pkg-config"

GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build797544696=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I'm trying to install https://github.com/golangci/golangci-lint with go get.
The pre-compiled binaries don't seem to work properly with Go 1.13. ( golangci/golangci-lint#604 )
That's why I'm trying to install it from the source.

➜  ~ GOPROXY=direct GO111MODULE=on go get -u github.com/golangci/golangci-lint/cmd/golangci-lint@v1.17.1                                 
go: finding github.com/golangci/golangci-lint/cmd/golangci-lint v1.17.1
go: finding github.com/golangci/golangci-lint/cmd v1.17.1
go get: github.com/golangci/golangci-lint@v1.17.1 requires
	github.com/go-critic/go-critic@v0.0.0-20181204210945-1df300866540: invalid pseudo-version: does not match version-control timestamp (2019-05-26T07:48:19Z)

I understand the cause of the issue, so I've submitted a PR that fixes it.
golangci/golangci-lint#605

Sadly, it seems that the maintainer is not available anymore (he doesn't answer).
golangci/golangci-lint#647

So I'm now trying to install from the commit of my PR:
golangci/golangci-lint@c3a532e

➜  ~ GOPROXY=direct GO111MODULE=on go get -v -u github.com/golangci/golangci-lint/cmd/golangci-lint@c3a532efb9406c70f07587f8c647b7f8ad92f676
go: finding github.com/golangci/golangci-lint c3a532efb9406c70f07587f8c647b7f8ad92f676
go: finding github.com/golangci/golangci-lint/cmd/golangci-lint c3a532efb9406c70f07587f8c647b7f8ad92f676
go: finding github.com/golangci/golangci-lint/cmd c3a532efb9406c70f07587f8c647b7f8ad92f676
go get github.com/golangci/golangci-lint/cmd/golangci-lint@c3a532efb9406c70f07587f8c647b7f8ad92f676: github.com/golangci/golangci-lint/cmd/golangci-lint@c3a532efb9406c70f07587f8c647b7f8ad92f676: invalid version: unknown revision c3a532efb9406c70f07587f8c647b7f8ad92f676

But it seems to fail.

I remember reading something about go get restricting the allowed commits.
There was some concern about a security issue.
But I can't find the source of this comment anymore.

What did you expect to see?

I would like to be able to install golangci-lint from source.
Or is there a better way ?

[bcmills]

Rejection of unmerged PR commits is intentional, and we've had to do significant work to maintain it (see #31191) — we want module authors to decide which versions of their own module participate in minimal version selection.

For the particular use-case of fixing an upstream dependency without an active maintainer, the right long-term approach is probably to fork the dependency to a new module path. But right now we don't have a good migration path for hard forks — that's why #26904 is one of my top priorities for modules in 1.14.

[bcmills]

To summarize:

• Short term: start a fork of golangci-lint with a go.mod file that declares its module path to also be github.com/golangci/golangci-lint, and use a replace directive to direct builds within your module to use that fork.

• Long term: start a fork of golangci-lint with its own unique import path, and migrate your (transitive) dependencies over to it. If any of the packages in golangci-lint require consistent global state, you may need to use whatever mechanism we end up with for cmd/go: allow replacement modules to alias other active modules #26904 during the migration.

[bcmills]

Closing as incompatible with #31191.

[pierrre]

@bcmills OK 👍 thank you for your help