internal/postgres: ensure good version not later than cooked

The good latest version of a module should never be later than the
cooked latest version. If it is, then pkgsite will show a different
version than the go command will download.

One way this can happen is if a module retracts all tagged versions,
and pseudo-versions were built on top of some of them. For example,
initially it could have versions

	v0.1.0
	v0.1.0-DATE-HASH (a pseudo-version)

Then v0.1.0 is retracted and a new pseudo-version appears at
head:

	v0.1.0 (retracted)
	v0.1.0-DATE-HASH
	v0.0.0-DATE-HASH (head of default branch)

The go command will get the v0.0.0 version, but technically
the v0.1.0 is later.

For golang/go#43265

Change-Id: I8ff30de4eb2dcdf108205de99af93d2f31772cff
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/318069
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
Reviewed-by: Julie Qiu <julie@golang.org>

1 files changed, 15 insertions, 0 deletions

diff --git a/internal/postgres/unit.go b/internal/postgres/unit.go
index 72efd278..2b70d55e 100644
--- a/internal/postgres/unit.go
+++ b/internal/postgres/unit.go
@@ -188,6 +188,21 @@ func (db *DB) getLatestUnitVersion(ctx context.Context, fullPath, requestedModul
 		if !version.IsIncompatible(lmv.CookedVersion) {
 			unretractedVersions = version.RemoveIf(unretractedVersions, version.IsIncompatible)
 		}
+		// The good version should never be later than the cooked version.
+		// https://golang.org/issue/43265 documents how that could happen:
+		// 1. A pseudo-version is created off of a tagged version. In this case,
+		//    golang.zx2c4.com/wireguard@v0.0.20201119-0.20210128142622-6a128dde71d9.
+		// 2. All tagged versions are retracted.
+		// 3. A new pseudo-version is published. In this case, v0.0.0-20210506092213-60a26371f42f.
+		// Technically, the first pseudo-version is higher than the second, so it
+		// is the latest good version. But the proxy's latest endpoint returns
+		// the second pseudo-version, so that is the cooked version (and what the
+		// go command will download).
+		if lmv.CookedVersion != "" {
+			unretractedVersions = version.RemoveIf(unretractedVersions, func(v string) bool {
+				return version.Later(v, lmv.CookedVersion)
+			})
+		}
 		latestVersion = version.LatestOf(unretractedVersions)
 		break
 	}