Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: 'go mod tidy' should retain go.sum entries for the module graph with and without replacements #29182

bcmills opened this issue Dec 12, 2018 · 3 comments


Copy link

@bcmills bcmills commented Dec 12, 2018

Today, go mod tidy trims go.mod and go.sum to just what is needed when building the main module as viewed from inside that module.

However, in many cases users of the module will build from outside that module (especially given #24250). Builds from outside may need additional modules to satisfy the imports as seen from outside, and may need to check sums for those additional modules as well (see #28802).

go mod tidy should ensure that both views of the module are complete and reproducible. That is, it should include enough requirements to satisfy the transitive import graph in both views (and regardless of build tags).

(A flag to compute only the outside view, as in #24666, would not suffice: go mod tidy using only an outside view could lead to missing requirements for builds from inside the module.)

Copy link

@jtlisi jtlisi commented Jul 8, 2020

@bcmills Is there a recommended workaround when encountering this issue? Is the best recourse to abuse the replace directive even further?

Copy link
Member Author

@bcmills bcmills commented Jul 20, 2020

@jtlisi, this issue is probably less relevant now that #28802 is withdrawn: the go.sum file for the main module is only used when inside that module, so it probably suffices for it to only contain the checksum entries for the internal view of that module.

Copy link
Member Author

@bcmills bcmills commented Sep 8, 2020

Thinking about this some more: users outside the module will not use its go.sum file at all, and users inside the module will always apply its replace directives. So the only go.sum lines we need to retain at the moment are the replacements themselves.

That may change if the set of replacements can vary without changing the go.mod file contents (such as if we adopt #26640 or similar), but for now I think go mod tidy only needs to retain sums for the main module's view of its own dependencies, with replacements already applied.

@bcmills bcmills closed this Sep 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.