cmd/go: mitigate merge conflicts when modules are updated

[vcabbage]

I expect merge conflicts in go.mod and go.sum to be a relatively common occurrence.

Quoting from @bcmills in the Go Slack:

If you have a merge conflict no go.mod or go.sum, you can usually just remove the conflict markers (taking the union of the requirements) and then run go mod tidyto get back into a consistent state.

https://gophers.slack.com/archives/C9BMAAFFB/p1559923453042900?thread_ts=1559922004.041700&cid=C9BMAAFFB

This doesn't appear terribly burdensome but it does introduce friction in the development process. I'm opening this as an exploratory issue to investigate whether there's anything the tooling can/should do to mitigate the conflict.

My off the cuff question was whether go mod tidy could be updated to understand conflicts and automatically resolve them in go.mod and go.sum. My summary of the resulting conversation is that it's likely possible but it's unclear whether it's desirable.

Some of the reasons against that were brought up:

• Both parsing of the conflicts and resolving them is VCS specific.
• This may be expanding the scope of what tidy is responsible for farther than it should be.

It's possible there's a less invasive approach to mitigating conflicts so I'm including the above suggestion only as one potential option to explore.

[bcmills]

CC @jayconrod

[WIZARDISHUNGRY]

I'd be interested in writing git specific merge driver for go.sum, if anyone else is thinking of the same thing.

[bcmills]

Thinking about this some more... if the area under the merge tokens contains a replace, require, or exclude token, then it isn't correct to just combine the contents. So the merge tool will at least need to know when to call for human intervention.

[rbUUbr]

what about just deleting go.sum and running go mod download?

[bcmills]

@rbUUbr, the point of the go.sum file is to ensure that the checksums do not change once a given version is downloaded. Especially for private dependencies that are not present in the global checksum database, it is important not to discard the originally-recorded checksums.