From 509592d188f6a30bb65b27a24f4c6f68716ea063 Mon Sep 17 00:00:00 2001
From: "Bryan C. Mills" <bcmills@google.com>
Date: Thu, 9 Jan 2020 11:19:16 -0500
Subject: [PATCH] cmd/go: explicitly reject 'list -u' and 'list -versions' when
 '-mod=vendor' is set

The information requested by these flags is not available from the
vendor directory.

Noticed while diagnosing #36478.

Updates #33848

Change-Id: I2b181ba5c27f01fdd6277d8d0ab1003c05774ff7
Reviewed-on: https://go-review.googlesource.com/c/go/+/214081
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Jay Conrod <jayconrod@google.com>
---
 src/cmd/go/internal/list/list.go          | 13 +++++++++++--
 src/cmd/go/testdata/script/mod_vendor.txt |  6 ++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/cmd/go/internal/list/list.go b/src/cmd/go/internal/list/list.go
index 4502289646..8d979e276f 100644
--- a/src/cmd/go/internal/list/list.go
+++ b/src/cmd/go/internal/list/list.go
@@ -390,15 +390,24 @@ func runList(cmd *base.Command, args []string) {
 
 		modload.InitMod() // Parses go.mod and sets cfg.BuildMod.
 		if cfg.BuildMod == "vendor" {
+			const actionDisabledFormat = "go list -m: can't %s using the vendor directory\n\t(Use -mod=mod or -mod=readonly to bypass.)"
+
+			if *listVersions {
+				base.Fatalf(actionDisabledFormat, "determine available versions")
+			}
+			if *listU {
+				base.Fatalf(actionDisabledFormat, "determine available upgrades")
+			}
+
 			for _, arg := range args {
 				// In vendor mode, the module graph is incomplete: it contains only the
 				// explicit module dependencies and the modules that supply packages in
 				// the import graph. Reject queries that imply more information than that.
 				if arg == "all" {
-					base.Fatalf("go list -m: can't compute 'all' using the vendor directory\n\t(Use -mod=mod or -mod=readonly to bypass.)")
+					base.Fatalf(actionDisabledFormat, "compute 'all'")
 				}
 				if strings.Contains(arg, "...") {
-					base.Fatalf("go list -m: can't match module patterns using the vendor directory\n\t(Use -mod=mod or -mod=readonly to bypass.)")
+					base.Fatalf(actionDisabledFormat, "match module patterns")
 				}
 			}
 		}
diff --git a/src/cmd/go/testdata/script/mod_vendor.txt b/src/cmd/go/testdata/script/mod_vendor.txt
index bb3e634b3a..2622916f61 100644
--- a/src/cmd/go/testdata/script/mod_vendor.txt
+++ b/src/cmd/go/testdata/script/mod_vendor.txt
@@ -38,6 +38,12 @@ stdout 'src[\\/]vendor[\\/]x'
 go list -mod=vendor -f '{{.Version}} {{.Dir}}' -m x
 stdout '^v1.0.0 $'
 
+# -mod=vendor should cause 'go list' flags that look up versions to fail.
+! go list -mod=vendor -versions -m x
+stderr '^go list -m: can''t determine available versions using the vendor directory\n\t\(Use -mod=mod or -mod=readonly to bypass.\)$'
+! go list -mod=vendor -u -m x
+stderr '^go list -m: can''t determine available upgrades using the vendor directory\n\t\(Use -mod=mod or -mod=readonly to bypass.\)$'
+
 # 'go list -mod=vendor -m' on a transitive dependency that does not
 # provide vendored packages should give a helpful error rather than
 # 'not a known dependency'.