internal/fetch: check for mismatched path

Read the go.mod file from the proxy, and check if its path differs
from the module path. If they do differ, fail with an
AlternativeModule error, and record the relationship between the two
paths in a table for future use.

This change means that the discovery site will not serve modules that:

- are case variants of the canonical path
  e.g. github.com/Sirupsen/logrus vs. the correct github.com/sirupsen/logrus

- bypass the vanity import path
  e.g. github.com/gonum/gonum vs. the correct gonum.org/v1/gonum

- are "soft forks" of the module's repo: forks with an unchanged go.mod path
  e.g. github.com/alice02/kubernetes vs. the correct k8s.io/kubernetes

Change-Id: If78c94744440112f5720750885fe10f6a7dc7ab8
Reviewed-on: https://team-review.git.corp.google.com/c/golang/discovery/+/623922
Reviewed-by: Julie Qiu <julieqiu@google.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/internal/stdlib/stdlib_test.go b/internal/stdlib/stdlib_test.go
index 5ceda9c0..47fa1d74 100644
--- a/internal/stdlib/stdlib_test.go
+++ b/internal/stdlib/stdlib_test.go
@@ -5,6 +5,7 @@
 package stdlib
 
 import (
+	"io/ioutil"
 	"reflect"
 	"strings"
 	"testing"
@@ -145,6 +146,23 @@ func TestZip(t *testing.T) {
 			if len(wantFiles) > 0 {
 				t.Errorf("zip missing files: %v", reflect.ValueOf(wantFiles).MapKeys())
 			}
+			for _, f := range zr.File {
+				if f.Name == wantPrefix+"go.mod" {
+					r, err := f.Open()
+					if err != nil {
+						t.Fatal(err)
+					}
+					defer r.Close()
+					b, err := ioutil.ReadAll(r)
+					if err != nil {
+						t.Fatal(err)
+					}
+					if got, want := string(b), "module std\n"; got != want {
+						t.Errorf("go.mod: got %q, want %q", got, want)
+					}
+					break
+				}
+			}
 		})
 	}
 }