cmd/go/internal/modload: do not resolve an arbitrary version for 'go list --versions'

If we don't actually require the listed module, we previously
implicitly resolved "latest", but also (erroneously) forgot to apply
exclusions and retractions for it. But there is really no need to
resolve "latest" in this case at all — now we omit the version from
the reported module info entirely.

Fixes #44296

Change-Id: Id595f52f597c7213bd65b73bf066a678d9e1d694
Reviewed-on: https://go-review.googlesource.com/c/go/+/297150
Trust: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
diff --git a/src/cmd/go/internal/modload/build.go b/src/cmd/go/internal/modload/build.go
index 8ad5f83..5a151b4 100644
--- a/src/cmd/go/internal/modload/build.go
+++ b/src/cmd/go/internal/modload/build.go
@@ -113,7 +113,11 @@
 	if listRetracted {
 		allowed = CheckExclusions
 	}
-	m.Versions, _ = versions(ctx, m.Path, allowed)
+	var err error
+	m.Versions, err = versions(ctx, m.Path, allowed)
+	if err != nil && m.Error == nil {
+		m.Error = &modinfo.ModuleError{Err: err.Error()}
+	}
 }
 
 // addRetraction fills in m.Retracted if the module was retracted by its author.
diff --git a/src/cmd/go/internal/modload/list.go b/src/cmd/go/internal/modload/list.go
index 3491f94..de16c2f 100644
--- a/src/cmd/go/internal/modload/list.go
+++ b/src/cmd/go/internal/modload/list.go
@@ -136,17 +136,9 @@
 				if listVersions {
 					// Don't make the user provide an explicit '@latest' when they're
 					// explicitly asking what the available versions are.
-					// Instead, resolve the module, even if it isn't an existing dependency.
-					info, err := Query(ctx, arg, "latest", "", nil)
-					if err == nil {
-						mod := moduleInfo(ctx, module.Version{Path: arg, Version: info.Version}, false, listRetracted)
-						mods = append(mods, mod)
-					} else {
-						mods = append(mods, &modinfo.ModulePublic{
-							Path:  arg,
-							Error: modinfoError(arg, "", err),
-						})
-					}
+					// Instead, return a modinfo without a version,
+					// to which we can attach the requested version list.
+					mods = append(mods, &modinfo.ModulePublic{Path: arg})
 					continue
 				}
 				if cfg.BuildMod == "vendor" {
diff --git a/src/cmd/go/testdata/script/mod_proxy_https.txt b/src/cmd/go/testdata/script/mod_proxy_https.txt
index a23090c..a5e28dd 100644
--- a/src/cmd/go/testdata/script/mod_proxy_https.txt
+++ b/src/cmd/go/testdata/script/mod_proxy_https.txt
@@ -10,6 +10,7 @@
 # GOPROXY HTTPS paths may elide the "https://" prefix.
 # (See golang.org/issue/32191.)
 env GOPROXY=proxy.golang.org
+env GOSUMDB=
 go list -versions -m golang.org/x/text
 
 -- go.mod --
diff --git a/src/cmd/go/testdata/script/mod_retract_versions.txt b/src/cmd/go/testdata/script/mod_retract_versions.txt
index 93ce592..961a0a1 100644
--- a/src/cmd/go/testdata/script/mod_retract_versions.txt
+++ b/src/cmd/go/testdata/script/mod_retract_versions.txt
@@ -10,9 +10,8 @@
 stdout '^example.com/retract/self/pseudo: "module example.com/retract/self/pseudo: no matching versions for query \\"latest\\"" "latest"$'
 
 
-	# BUG(#44296): Adding --versions should not cause a retracted version to be reported.
 go list -m -e -f $FMT --versions example.com/retract/self/pseudo
-stdout '^example.com/retract/self/pseudo "v1.9.0"$'
+stdout '^example.com/retract/self/pseudo ""$'
 
 go list -m -e -f $FMT --versions example.com/retract/self/pseudo@latest
 stdout '^example.com/retract/self/pseudo: "module example.com/retract/self/pseudo: no matching versions for query \\"latest\\"" "latest"$'