cmd/go: go mod graph shows indirect dependencies as requirements of main module

[misha-tectonic]

What version of Go are you using (go version)?

Go 1.11

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/dottedmag/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/dottedmag/go"
GOPROXY=""
GORACE=""
GOROOT="/Users/dottedmag/kobold/deps/go1.11.darwin-amd64/dist"
GOTMPDIR=""
GOTOOLDIR="/Users/dottedmag/kobold/deps/go1.11.darwin-amd64/dist/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/dottedmag/tmp/bar/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/mt/1tmwnxv96cg2vl1nz74_c9cm0000gn/T/go-build032453213=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

$ go mod init foo.bar
$ go get github.com/tendermint/go-amino
$ echo 'package main

import amino "github.com/tendermint/go-amino"

func main() {
    print(amino.Version)
}' > main.go
$ go mod tidy
$ go mod graph

What did you expect to see?

github.com/tendermint/go-amino@v0.12.0 github.com/davecgh/go-spew@v1.1.1
github.com/tendermint/go-amino@v0.12.0 github.com/google/gofuzz@v0.0.0-20170612174753-24818f796faf
github.com/davecgh/go-spew@v1.1.1 github.com/pmezard/go-difflib@v1.0.0
github.com/tendermint/go-amino@v0.12.0 github.com/stretchr/testify@v1.2.2
foo.bar github.com/tendermint/go-amino@v0.12.0

What did you see instead?

foo.bar github.com/davecgh/go-spew@v1.1.1
foo.bar github.com/google/gofuzz@v0.0.0-20170612174753-24818f796faf
foo.bar github.com/pmezard/go-difflib@v1.0.0
foo.bar github.com/stretchr/testify@v1.2.2
foo.bar github.com/tendermint/go-amino@v0.12.0

Only happens with indirect dependencies.

[rajender]

I am also facing this issue.

[root@dev backend]# cat go.mod
module backend

require (
github.com/360EntSecGroup-Skylar/excelize v1.3.0
github.com/aws/aws-lambda-go v1.6.0
github.com/aws/aws-sdk-go v1.15.22
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/google/uuid v0.0.0-20180827204232-d460ce9f8df2 // indirect
github.com/gopherjs/gopherjs v0.0.0-20180825215210-0210a2f0f73c // indirect
github.com/jtolds/gls v4.2.1+incompatible // indirect
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646
github.com/pborman/uuid v0.0.0-20180827223501-4c1ecd6722e8
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/sergi/go-diff v1.0.0 // indirect
github.com/smartystreets/assertions v0.0.0-20180820201707-7c9eb446e3cf // indirect
github.com/smartystreets/goconvey v0.0.0-20180222194500-ef6db91d284a // indirect
github.com/stretchr/testify v1.2.2 // indirect
github.com/stripe/stripe-go v43.0.0+incompatible
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d // indirect
golang.org/x/text v0.3.0 // indirect
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2 // indirect
googlemaps.github.io/maps v0.0.0-20180819235337-ce25c900cc16
)
[root@dev backend]# go mod graph
backend github.com/360EntSecGroup-Skylar/excelize@v1.3.0
backend github.com/aws/aws-lambda-go@v1.6.0
backend github.com/aws/aws-sdk-go@v1.15.22
backend github.com/davecgh/go-spew@v1.1.1
backend github.com/google/uuid@v0.0.0-20180827204232-d460ce9f8df2
backend github.com/gopherjs/gopherjs@v0.0.0-20180825215210-0210a2f0f73c
backend github.com/jtolds/gls@v4.2.1+incompatible
backend github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826
backend github.com/nfnt/resize@v0.0.0-20180221191011-83c6a9932646
backend github.com/pborman/uuid@v0.0.0-20180827223501-4c1ecd6722e8
backend github.com/pmezard/go-difflib@v1.0.0
backend github.com/sergi/go-diff@v1.0.0
backend github.com/smartystreets/assertions@v0.0.0-20180820201707-7c9eb446e3cf
backend github.com/smartystreets/goconvey@v0.0.0-20180222194500-ef6db91d284a
backend github.com/stretchr/testify@v1.2.2
backend github.com/stripe/stripe-go@v43.0.0+incompatible
backend golang.org/x/net@v0.0.0-20180826012351-8a410e7b638d
backend golang.org/x/text@v0.3.0
backend golang.org/x/time@v0.0.0-20180412165947-fbb02b2291d2
backend googlemaps.github.io/maps@v0.0.0-20180819235337-ce25c900cc16
github.com/aws/aws-sdk-go@v1.15.22 github.com/go-ini/ini@v1.25.4
github.com/aws/aws-sdk-go@v1.15.22 github.com/jmespath/go-jmespath@v0.0.0-20160202185014-0b12d6b521d8

[rajender]

@gopherbot add label modules

[myitcv]

I believe this is working as intended. Quoting go help modules:

As part of maintaining the require statements in go.mod, the go command
tracks which ones provide packages imported directly by the current module
and which ones provide packages only used indirectly by other module
dependencies. Requirements needed only for indirect uses are marked with a
"// indirect" comment in the go.mod file. Indirect requirements are
automatically removed from the go.mod file once they are implied by other
direct requirements. Indirect requirements only arise when using modules
that fail to state some of their own dependencies or when explicitly
upgrading a module's dependencies ahead of its own stated requirements.

The critical sentence is the last one.

This might help: https://github.com/go-modules-by-example/index/blob/master/018_go_list_mod_graph_why/README.md

cc @bcmills but I'm going to mark this as closed.

[bcmills]

go mod graph displays the module graph as it exists. A missing requirement in a dependency doesn't impose any constraints on what version is used to satisfy the import, so it doesn't belong in the graph: you need some version of github.com/davecgh/go-spew to satisfy github.com/tendermint/go-amino, but you don't need v1.1.1 specifically (and an older version would likely work just fine).

go mod why explains the relationship between the package import graph and the module graph. That's the tool to use here.