modfile: check canonicalness against the relevant module path, not abstract semver

In CL 279394 we started validating that versions in "exclude" and
"retract" directives are canonical. Unfortunately, we use the semver
package's notion of canonicalness, and the semver package doesn't know
anything about +incompatible versions or major-version suffixes.

The resulting error messages also don't indicate an appropriate fix if
the problem is that the user forgot either the "+incompatible" suffix
on the version string or the "/vN" suffix on the module path.

This change corrects both of those problems by validating the version
against the corresponding module path. (For "exclude" directives, that
is the module path to be excluded; for "retract" directives, it is the
module declared in the "module" directive of the same go.mod file.)

For golang/go#44497

Change-Id: I39732d79c3ab3a43bb1fb8905062fe6cb26d3edc
Trust: Bryan C. Mills <>
Reviewed-by: Jay Conrod <>
Reviewed-by: Michael Matloob <>
2 files changed
tree: 2445f9c3bfc5105ad4b25d01ffcb2ebbe5b0b580
  4. codereview.cfg
  5. go.mod
  6. go.sum
  7. gosumcheck/
  8. internal/
  9. modfile/
  10. module/
  11. semver/
  12. sumdb/
  13. zip/



This repository holds packages for writing tools that work directly with Go module mechanics. That is, it is for direct manipulation of Go modules themselves.

It is NOT about supporting general development tools that need to do things like load packages in module mode. That use case, where modules are incidental rather than the focus, should remain in x/tools, specifically x/tools/go/packages.

The specific case of loading packages should still be done by invoking the go command, which remains the single point of truth for package loading algorithms.