language/go: don't let 'go mod download' edit go.sum

cmd/gazelle/integration_test.go

@@ -4210,3 +4210,47 @@ go_library(
 `,
 	}})
 }
+
+// TestUpdateReposDoesNotModifyGoSum verifies that commands executed by
+// update-repos do not modify go.sum, particularly 'go mod download' when
+// a sum is missing. Verifies #990.
+//
+// This could also be tested in language/go/update_import_test.go, but that
+// test relies on stubs for speed, and it's important to run the real
+// go command here.
+func TestUpdateReposDoesNotModifyGoSum(t *testing.T) {
+	if testing.Short() {
+		// Test may download small files over network.
+		t.Skip()
+	}
+	goSumFile := testtools.FileSpec{
+		// go.sum only contains the sum for the mod file, not the content.
+		// This is common for transitive dependencies not needed by the main module.
+		Path:    "go.sum",
+		Content: "golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=\n",
+	}
+	files := []testtools.FileSpec{
+		{
+			Path:    "WORKSPACE",
+			Content: "# gazelle:repo bazel_gazelle",
+		},
+		{
+			Path: "go.mod",
+			Content: `
+module test
+
+go 1.16
+
+require golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
+`,
+		},
+		goSumFile,
+	}
+	dir, cleanup := testtools.CreateFiles(t, files)
+	defer cleanup()
+
+	if err := runGazelle(dir, []string{"update-repos", "-from_file=go.mod"}); err != nil {
+		t.Fatal(err)
+	}
+	testtools.CheckFiles(t, dir, []testtools.FileSpec{goSumFile})
+}

language/go/modules.go

@@ -73,6 +73,7 @@ func importReposFromModules(args language.ImportReposArgs) language.ImportReposR
 			pathToModule[mod.Path+"@"+mod.Version] = mod
 		}
 	}
+
 	// Load sums from go.sum. Ideally, they're all there.
 	goSumPath := filepath.Join(filepath.Dir(args.Path), "go.sum")
 	data, _ = ioutil.ReadFile(goSumPath)
@@ -91,15 +92,24 @@ func importReposFromModules(args language.ImportReposArgs) language.ImportReposR
 			mod.Sum = sum
 		}
 	}
-	// If sums are missing, run go mod download to get them.
+
+	// If sums are missing, run 'go mod download' to get them.
+	// This must be done in a temporary directory because 'go mod download'
+	// may modify go.mod and go.sum. It does not support -mod=readonly.
 	var missingSumArgs []string
 	for pathVer, mod := range pathToModule {
 		if mod.Sum == "" {
 			missingSumArgs = append(missingSumArgs, pathVer)
 		}
 	}
+
 	if len(missingSumArgs) > 0 {
-		data, err := goModDownload(dir, missingSumArgs)
+		tmpDir, err := ioutil.TempDir("", "")
+		if err != nil {
+			return language.ImportReposResult{Error: fmt.Errorf("finding module sums: %v", err)}
+		}
+		defer os.RemoveAll(tmpDir)
+		data, err := goModDownload(tmpDir, missingSumArgs)
 		if err != nil {
 			return language.ImportReposResult{Error: err}
 		}