Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: go build -mod=readonly should disallow go.sum updates #30667

Closed
rsc opened this issue Mar 8, 2019 · 2 comments
Closed

cmd/go: go build -mod=readonly should disallow go.sum updates #30667

rsc opened this issue Mar 8, 2019 · 2 comments
Assignees
Milestone

Comments

@rsc
Copy link
Contributor

@rsc rsc commented Mar 8, 2019

go build -mod=readonly disallows go.mod updates.
It should also disallow go.sum updates.
Maybe it already does; I haven't checked.

@marwan-at-work

This comment has been minimized.

Copy link
Contributor

@marwan-at-work marwan-at-work commented Mar 8, 2019

can confirm that -mod=readonly does not disallow go.sum updates.

go mod init reproduce 
go get github.com/pkg/errors
echo "" > go.sum
go build -mod=readonly
@gopherbot

This comment has been minimized.

Copy link

@gopherbot gopherbot commented Mar 8, 2019

Change https://golang.org/cl/166237 mentions this issue: cmd/go: disallow go.sum updates in -mod=readonly

@bcmills bcmills added the NeedsFix label Mar 28, 2019
@gopherbot gopherbot closed this in d21c7b7 May 8, 2019
@thepudds thepudds added the modules label May 14, 2019
anoadragon453 added a commit to matrix-org/dendrite that referenced this issue Jul 12, 2019
Every time before sending a PR I like to run ./scripts/build-test-lint.sh to make sure the CI won't complain about anything.

The problem is that this script attempts to install golangci-lint, which causes modifications to go.mod/go.sum. This PR backs up and restores those files before and after linting.

Ideally instead of this hacky backing up/restoring we'd use go gets -mod=readonly option, but that still modifies go.sum. This will be fixed in go 1.13 apparently. golang/go#30667
davecheney added a commit to davecheney/contour that referenced this issue Sep 5, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Sep 5, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to projectcontour/contour that referenced this issue Sep 5, 2019
Fixes #1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to projectcontour/contour that referenced this issue Oct 3, 2019
Fixes #1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.