Add experimental Go module proxy support (#358)

* feat: add experimental Go module support via pmg go

Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command
runs solely when invoked explicitly as `pmg go ...` and is deliberately
excluded from setup aliases and PATH shims so existing users are
unaffected.

- packagemanager: goPackageManager with fail-safe command classification
  (vet/fix excluded from non-download since they can fetch on a cold
  cache) and pinned-version extraction where only canonical semver
  counts as explicit.
- GOPROXY normalization (fail-closed): effective GOPROXY read via
  `go env` (honors go env -w), rebuilt comma-joined with `direct`
  dropped so a 403 block is terminal and nothing silently falls back to
  unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning;
  GOINSECURE is cleared. Contributed to the proxy flow through a new
  ProxyRoutingProvider hook (extra child env + dynamic MITM hosts).
- Go interceptor with dynamic host matching from the user's effective
  GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on
  .zip only (the sole endpoint that delivers code); .info/.mod/@latest/
  list pass through; /sumdb/ traffic and sum.golang.org are never
  touched so checksum-db verification stays intact; golang.org/toolchain
  is allowed on Go's own checksum verification.
- Dependency cooldown: publish time captured from .info responses
  (body unmodified), in-window .zip blocked with 403; fails open for
  cooldown only when the publish time was never observed.
- Cert gate: on macOS/Windows `pmg go` fails fast with actionable
  guidance unless the persisted PMG CA is OS-trusted (Go ignores
  SSL_CERT_FILE there); Linux works via the injected bundle.
- proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic
  cases (allow/block/confirm, case-escaped paths, cooldown block and
  fail-open, toolchain, sumdb passthrough).

Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0`
MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch,
and go.sum verification succeeds through the tunneled checksum db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* fix(go): address review findings on experimental Go support

- Drop fmt/clean from NonDownloadCommands: both load packages via go
  list and can download modules on a cold cache, which would bypass the
  proxy under install_only.
- Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at
  https://corp/goproxy): the interceptor now receives host -> base URL
  and strips the path prefix before parsing module URLs, so verdicts
  and cooldown key on the real module path.
- Default unschemed GOPROXY entries to https, matching go's own
  behavior, so corp mirrors configured as bare hosts are intercepted
  instead of silently unanalyzed.
- Memoize the final verdict per module zip: go re-requests a failed
  zip during go get's load phase, which double-recorded stats (the
  report showed the same blocked module twice) and would have
  re-prompted on Confirm verdicts.
- Fetch .info out-of-band on a cooldown cache miss: go serves .info
  from its local module cache on any machine that used go before PMG,
  which silently disabled cooldown. Failure of the side-fetch still
  fails open for cooldown only.
- Move the noop package resolver into packagemanager.

Verified live: cold-cache cooldown block now records once; warm-cache
rerun is blocked via the side-fetch instead of failing open.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* docs: collapse Go proxy-mode details by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

---------

Co-authored-by: Claude <noreply@anthropic.com>

test/proxye2e/analyzer.go

@@ -103,6 +103,10 @@ func (r *AnalyzerRecorder) SetPypi(name, version string, v Verdict) {
 	r.set(packagev1.Ecosystem_ECOSYSTEM_PYPI, name, version, v)
 }
 
+func (r *AnalyzerRecorder) SetGo(name, version string, v Verdict) {
+	r.set(packagev1.Ecosystem_ECOSYSTEM_GO, name, version, v)
+}
+
 func (r *AnalyzerRecorder) set(eco packagev1.Ecosystem, name, version string, v Verdict) {
 	r.mu.Lock()
 	defer r.mu.Unlock()

test/proxye2e/driver.go

@@ -82,6 +82,48 @@ func (d NpmDriver) Install(name, version string) ExecResult {
 	return res
 }
 
+type GoDriver struct{ h *Harness }
+
+func (d GoDriver) goProxyURL(modulePath, version, ext string) string {
+	return fmt.Sprintf("https://proxy.golang.org/%s/@v/%s%s",
+		goEscapePath(modulePath), goEscapeVersion(version), ext)
+}
+
+// DownloadZipVia fetches a module zip from an arbitrary GOPROXY base URL,
+// e.g. a corporate proxy serving under a path prefix.
+func (d GoDriver) DownloadZipVia(baseURL, modulePath, version string) RequestOutcome {
+	return d.h.get(fmt.Sprintf("%s/%s/@v/%s.zip",
+		baseURL, goEscapePath(modulePath), goEscapeVersion(version)), nil)
+}
+
+func (d GoDriver) FetchInfo(modulePath, version string) RequestOutcome {
+	return d.h.get(d.goProxyURL(modulePath, version, ".info"), nil)
+}
+
+func (d GoDriver) FetchMod(modulePath, version string) RequestOutcome {
+	return d.h.get(d.goProxyURL(modulePath, version, ".mod"), nil)
+}
+
+func (d GoDriver) DownloadZip(modulePath, version string) RequestOutcome {
+	return d.h.get(d.goProxyURL(modulePath, version, ".zip"), nil)
+}
+
+// Install replays go's fetch sequence for a resolved module version:
+// .info, then .mod, then the .zip source archive.
+func (d GoDriver) Install(modulePath, version string) ExecResult {
+	res := ExecResult{}
+
+	info := d.FetchInfo(modulePath, version)
+	res.add(info)
+	if info.Err != nil || info.StatusCode != 200 {
+		return res
+	}
+
+	res.add(d.FetchMod(modulePath, version))
+	res.add(d.DownloadZip(modulePath, version))
+	return res
+}
+
 type PypiDriver struct{ h *Harness }
 
 type PypiSimpleFile struct {

test/proxye2e/harness.go

@@ -83,11 +83,20 @@ func New(t *testing.T, opts ...Option) *Harness {
 		interceptors.NewInMemoryAnalysisCache(),
 		stats,
 		confChan,
-		interceptors.InterceptorContext{PinnedVersions: o.pinnedVersions},
+		interceptors.InterceptorContext{
+			PinnedVersions: o.pinnedVersions,
+			// proxy.golang.org serves at the root of the plain-HTTP mock (also
+			// the base for out-of-band .info fetches); corp.example.com serves
+			// under a base path to exercise GOPROXY path-prefix stripping.
+			GoProxyBaseURLs: map[string]string{
+				"proxy.golang.org": registry.goBaseURL(),
+				"corp.example.com": registry.goBaseURL() + "/goproxy",
+			},
+		},
 	)
 
 	interceptorList := []proxy.Interceptor{interceptors.NewAuditLoggerInterceptor()}
-	for _, eco := range []packagev1.Ecosystem{packagev1.Ecosystem_ECOSYSTEM_NPM, packagev1.Ecosystem_ECOSYSTEM_PYPI} {
+	for _, eco := range []packagev1.Ecosystem{packagev1.Ecosystem_ECOSYSTEM_NPM, packagev1.Ecosystem_ECOSYSTEM_PYPI, packagev1.Ecosystem_ECOSYSTEM_GO} {
 		ic, ierr := factory.CreateInterceptor(eco)
 		require.NoError(t, ierr)
 		interceptorList = append(interceptorList, ic)
@@ -158,6 +167,7 @@ func (h *Harness) Close() {
 
 func (h *Harness) Npm() NpmDriver   { return NpmDriver{h: h} }
 func (h *Harness) Pypi() PypiDriver { return PypiDriver{h: h} }
+func (h *Harness) Go() GoDriver     { return GoDriver{h: h} }
 
 func (h *Harness) Stats() interceptors.AnalysisStats { return h.stats.GetStats() }
 

test/proxye2e/proxye2e_test.go

@@ -360,3 +360,210 @@ func TestProxyFlow_Pypi(t *testing.T) {
 		},
 	})
 }
+
+func TestProxyFlow_Go(t *testing.T) {
+	RunCases(t, []TestCase{
+		{
+			Name: "clean module is analyzed and allowed",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/m",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/m", "v1.0.0", Clean())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/m", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.False(t, res.Blocked())
+				assert.Equal(t, 1, h.Analyzer.AnalyzedCount("example.com/m", "v1.0.0"))
+				assert.True(t, h.Registry.DownloadedGoZip("example.com/m", "v1.0.0"))
+				assert.GreaterOrEqual(t, h.Stats().AllowedCount, 1)
+			},
+		},
+		{
+			Name: "verified malware is blocked at the zip download",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/evil",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/evil", "v1.0.0", VerifiedMalware())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/evil", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked())
+				assert.False(t, h.Registry.DownloadedGoZip("example.com/evil", "v1.0.0"),
+					"blocked module source must never reach the client")
+				assert.Len(t, h.BlockedPackages(), 1)
+			},
+		},
+		{
+			Name: "metadata requests are not analyzed",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/m",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+			},
+			Exec: func(h *Harness) ExecResult {
+				res := ExecResult{}
+				res.add(h.Go().FetchInfo("example.com/m", "v1.0.0"))
+				res.add(h.Go().FetchMod("example.com/m", "v1.0.0"))
+				return res
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.False(t, res.Blocked())
+				assert.Empty(t, h.Analyzer.Calls(), "info/mod metadata must not trigger analysis")
+			},
+		},
+		{
+			Name: "case-escaped module path is decoded before analysis",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "github.com/BurntSushi/toml",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("github.com/BurntSushi/toml", "v1.0.0", VerifiedMalware())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("github.com/BurntSushi/toml", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked(), "verdict keyed by decoded module path must match")
+				assert.Equal(t, 1, h.Analyzer.AnalyzedCount("github.com/BurntSushi/toml", "v1.0.0"))
+			},
+		},
+		{
+			Name: "suspicious module blocked when user declines",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/maybe",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/maybe", "v1.0.0", Suspicious())
+				h.Confirm.AutoDeny()
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/maybe", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked())
+				assert.Len(t, h.Confirm.Prompts(), 1)
+				assert.False(t, h.Registry.DownloadedGoZip("example.com/maybe", "v1.0.0"))
+			},
+		},
+		{
+			Name:   "cooldown blocks in-window version at the zip download",
+			Config: cooldownEnabled(7),
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/fresh",
+					Versions: []GoVersion{{Version: "v1.1.0", PublishedAt: recent()}}})
+				h.Analyzer.SetGo("example.com/fresh", "v1.1.0", Clean())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/fresh", "v1.1.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked())
+				assert.False(t, h.Registry.DownloadedGoZip("example.com/fresh", "v1.1.0"))
+				assert.GreaterOrEqual(t, h.Stats().CooldownBlockedCount, 1)
+
+				var found bool
+				for _, b := range h.CooldownBlocks() {
+					if b.Name == "example.com/fresh" && b.Version == "v1.1.0" {
+						found = true
+					}
+				}
+				assert.True(t, found, "in-window version should be recorded as a cooldown block")
+			},
+		},
+		{
+			Name:   "cooldown allows out-of-window version",
+			Config: cooldownEnabled(7),
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/m",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/m", "v1.0.0", Clean())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/m", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.False(t, res.Blocked())
+				assert.True(t, h.Registry.DownloadedGoZip("example.com/m", "v1.0.0"))
+				assert.Equal(t, 0, h.Stats().CooldownBlockedCount)
+			},
+		},
+		{
+			Name:   "cooldown side-fetches publish time when .info was cached locally",
+			Config: cooldownEnabled(7),
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/fresh",
+					Versions: []GoVersion{{Version: "v1.1.0", PublishedAt: recent()}}})
+				h.Analyzer.SetGo("example.com/fresh", "v1.1.0", Clean())
+			},
+			Exec: func(h *Harness) ExecResult {
+				// Zip fetched without a prior .info through the proxy (go
+				// served .info from its local module cache): the interceptor
+				// must fetch the publish time out-of-band and still block.
+				res := ExecResult{}
+				res.add(h.Go().DownloadZip("example.com/fresh", "v1.1.0"))
+				return res
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked(), "cooldown must block via the out-of-band .info fetch")
+				assert.GreaterOrEqual(t, h.Stats().CooldownBlockedCount, 1)
+				assert.Empty(t, h.Analyzer.Calls(), "blocked before malware analysis")
+			},
+		},
+		{
+			Name: "module served under a GOPROXY base path is analyzed and blocked",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/prefixed",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/prefixed", "v1.0.0", VerifiedMalware())
+			},
+			Exec: func(h *Harness) ExecResult {
+				res := ExecResult{}
+				res.add(h.Go().DownloadZipVia("https://corp.example.com/goproxy", "example.com/prefixed", "v1.0.0"))
+				return res
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked(), "base path must be stripped so the verdict applies")
+				assert.Equal(t, 1, h.Analyzer.AnalyzedCount("example.com/prefixed", "v1.0.0"))
+			},
+		},
+		{
+			Name: "repeated zip request for a blocked module records the verdict once",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/evil",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetGo("example.com/evil", "v1.0.0", VerifiedMalware())
+			},
+			Exec: func(h *Harness) ExecResult {
+				// go re-requests a failed zip during go get's load phase; the
+				// repeat must not double-count stats or re-run analysis.
+				res := ExecResult{}
+				res.add(h.Go().DownloadZip("example.com/evil", "v1.0.0"))
+				res.add(h.Go().DownloadZip("example.com/evil", "v1.0.0"))
+				return res
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Requests[0].Blocked)
+				assert.True(t, res.Requests[1].Blocked)
+				assert.Len(t, h.BlockedPackages(), 1, "repeat request must not duplicate the blocked record")
+				assert.Equal(t, 1, h.Stats().BlockedCount)
+				assert.Equal(t, 1, h.Analyzer.AnalyzedCount("example.com/evil", "v1.0.0"))
+			},
+		},
+		{
+			Name: "toolchain module is allowed without analysis",
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "golang.org/toolchain",
+					Versions: []GoVersion{{Version: "v0.0.1-go1.24.0.linux-amd64", PublishedAt: recent()}}})
+			},
+			Exec: func(h *Harness) ExecResult {
+				return h.Go().Install("golang.org/toolchain", "v0.0.1-go1.24.0.linux-amd64")
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.False(t, res.Blocked())
+				assert.True(t, h.Registry.DownloadedGoZip("golang.org/toolchain", "v0.0.1-go1.24.0.linux-amd64"))
+				assert.Empty(t, h.Analyzer.Calls(), "toolchain rides on Go's own checksum-db verification")
+			},
+		},
+		{
+			Name: "proxied checksum-database traffic passes through",
+			Exec: func(h *Harness) ExecResult {
+				res := ExecResult{}
+				res.add(h.get("https://proxy.golang.org/sumdb/sum.golang.org/supported", nil))
+				return res
+			},
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.False(t, res.Blocked())
+				assert.Empty(t, h.Analyzer.Calls())
+			},
+		},
+	})
+}

test/proxye2e/registry.go

@@ -6,9 +6,12 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"path"
 	"strings"
 	"sync"
 	"time"
+
+	"golang.org/x/mod/module"
 )
 
 type NpmVersion struct {
@@ -34,6 +37,16 @@ type PypiPackage struct {
 	Versions []PypiVersion
 }
 
+type GoVersion struct {
+	Version     string
+	PublishedAt time.Time
+}
+
+type GoModule struct {
+	Path     string
+	Versions []GoVersion
+}
+
 type RecordedRequest struct {
 	Host   string
 	Method string
@@ -47,22 +60,38 @@ type Registry struct {
 	mu       sync.Mutex
 	npm      map[string]NpmPackage
 	pypi     map[string]PypiPackage
+	gomod    map[string]GoModule
 	requests []RecordedRequest
 	server   *httptest.Server
+	goServer *httptest.Server
 }
 
 func newRegistry() *Registry {
 	r := &Registry{
-		npm:  map[string]NpmPackage{},
-		pypi: map[string]PypiPackage{},
+		npm:   map[string]NpmPackage{},
+		pypi:  map[string]PypiPackage{},
+		gomod: map[string]GoModule{},
 	}
 	r.server = httptest.NewTLSServer(http.HandlerFunc(r.serve))
+	// Plain-HTTP GOPROXY endpoint for the interceptor's out-of-band .info
+	// fetches, which go straight to the upstream base URL rather than through
+	// the proxy under test. It also serves the /goproxy base path used to
+	// exercise GOPROXY path-prefix handling.
+	r.goServer = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		r.record(req)
+		r.serveGoWithOptionalPrefix(w, req)
+	}))
 	return r
 }
 
 func (r *Registry) addr() string { return r.server.Listener.Addr().String() }
 
-func (r *Registry) close() { r.server.Close() }
+func (r *Registry) goBaseURL() string { return r.goServer.URL }
+
+func (r *Registry) close() {
+	r.server.Close()
+	r.goServer.Close()
+}
 
 func (r *Registry) AddNpm(pkg NpmPackage) {
 	r.mu.Lock()
@@ -76,6 +105,12 @@ func (r *Registry) AddPypi(pkg PypiPackage) {
 	r.pypi[normalizePypiName(pkg.Name)] = pkg
 }
 
+func (r *Registry) AddGoModule(mod GoModule) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.gomod[mod.Path] = mod
+}
+
 // Requests returns every request the proxy forwarded upstream, in order.
 func (r *Registry) Requests() []RecordedRequest {
 	r.mu.Lock()
@@ -97,25 +132,138 @@ func (r *Registry) DownloadedTarball(name, version string) bool {
 	return false
 }
 
-func (r *Registry) serve(w http.ResponseWriter, req *http.Request) {
-	host := hostOnly(req.Host)
-
+func (r *Registry) record(req *http.Request) {
 	r.mu.Lock()
-	r.requests = append(r.requests, RecordedRequest{Host: host, Method: req.Method, Path: req.URL.Path})
-	r.mu.Unlock()
+	defer r.mu.Unlock()
+	r.requests = append(r.requests, RecordedRequest{Host: hostOnly(req.Host), Method: req.Method, Path: req.URL.Path})
+}
 
-	switch host {
+func (r *Registry) serve(w http.ResponseWriter, req *http.Request) {
+	r.record(req)
+
+	switch hostOnly(req.Host) {
 	case "registry.npmjs.org", "registry.yarnpkg.com":
 		r.serveNpm(w, req)
 	case "pypi.org":
 		r.servePypiSimple(w, req)
 	case "files.pythonhosted.org":
 		r.servePypiFile(w, req)
+	case "proxy.golang.org", "corp.example.com":
+		r.serveGoWithOptionalPrefix(w, req)
 	default:
 		http.NotFound(w, req)
 	}
 }
 
+// serveGoWithOptionalPrefix serves the GOPROXY protocol either at the root
+// (proxy.golang.org) or under the /goproxy base path (corp.example.com and
+// the corp base URL of the plain-HTTP go server).
+func (r *Registry) serveGoWithOptionalPrefix(w http.ResponseWriter, req *http.Request) {
+	if strings.HasPrefix(req.URL.Path, "/goproxy/") {
+		http.StripPrefix("/goproxy", http.HandlerFunc(r.serveGo)).ServeHTTP(w, req)
+		return
+	}
+	r.serveGo(w, req)
+}
+
+// DownloadedGoZip reports whether the module zip for the given path and
+// version was fetched from the registry.
+func (r *Registry) DownloadedGoZip(modulePath, version string) bool {
+	want := "/" + goEscapePath(modulePath) + "/@v/" + goEscapeVersion(version) + ".zip"
+	for _, req := range r.Requests() {
+		if req.Path == want {
+			return true
+		}
+	}
+	return false
+}
+
+// serveGo implements a minimal GOPROXY protocol endpoint: .info (with publish
+// time), .mod and .zip per registered module version, plus /sumdb/* which the
+// real proxy serves for checksum-database lookups.
+func (r *Registry) serveGo(w http.ResponseWriter, req *http.Request) {
+	p := strings.TrimPrefix(req.URL.Path, "/")
+
+	if strings.HasPrefix(p, "sumdb/") {
+		_, _ = w.Write([]byte("e2e-sumdb"))
+		return
+	}
+
+	escapedPath, versionPart, found := strings.Cut(p, "/@v/")
+	if !found {
+		http.NotFound(w, req)
+		return
+	}
+
+	modulePath, err := module.UnescapePath(escapedPath)
+	if err != nil {
+		http.NotFound(w, req)
+		return
+	}
+
+	r.mu.Lock()
+	mod, ok := r.gomod[modulePath]
+	r.mu.Unlock()
+	if !ok {
+		http.NotFound(w, req)
+		return
+	}
+
+	ext := path.Ext(versionPart)
+	version, err := module.UnescapeVersion(strings.TrimSuffix(versionPart, ext))
+	if err != nil {
+		http.NotFound(w, req)
+		return
+	}
+
+	var published time.Time
+	versionFound := false
+	for _, v := range mod.Versions {
+		if v.Version == version {
+			published = v.PublishedAt
+			versionFound = true
+			break
+		}
+	}
+	if !versionFound {
+		http.NotFound(w, req)
+		return
+	}
+
+	switch ext {
+	case ".info":
+		w.Header().Set("Content-Type", "application/json")
+		body, _ := json.Marshal(map[string]string{
+			"Version": version,
+			"Time":    published.UTC().Format(time.RFC3339),
+		})
+		_, _ = w.Write(body)
+	case ".mod":
+		_, _ = fmt.Fprintf(w, "module %s\n", modulePath)
+	case ".zip":
+		w.Header().Set("Content-Type", "application/zip")
+		_, _ = w.Write([]byte("e2e-module-zip"))
+	default:
+		http.NotFound(w, req)
+	}
+}
+
+func goEscapePath(p string) string {
+	escaped, err := module.EscapePath(p)
+	if err != nil {
+		return p
+	}
+	return escaped
+}
+
+func goEscapeVersion(v string) string {
+	escaped, err := module.EscapeVersion(v)
+	if err != nil {
+		return v
+	}
+	return escaped
+}
+
 func (r *Registry) serveNpm(w http.ResponseWriter, req *http.Request) {
 	path := strings.Trim(req.URL.Path, "/")