Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: module project cannot update go.sum file in readonly mode #34054

Open
davecheney opened this issue Sep 4, 2019 · 10 comments

Comments

@davecheney
Copy link
Contributor

commented Sep 4, 2019

What version of Go are you using (go version)?

$ go version
go version go1.13 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env

What did you do?

In attempting to upgrade my project from Go 1.12 to Go 1.13 our project will not build because -mod=readonly wants to update the go.sum file but is prevented from doing so by its own logic.

Go 1.12 happily made whatever changes were necessary to the sum file,

% rm go.sum
% env GO111MODULE=on go1.12  install -mod=readonly -v -tags "oidc gcp" github.com/heptio/contour/cmd/contour
% wc -l go.sum
     275 go.sum

What did you expect to see?

Build succeeds

What did you see instead?

Project, https://github.com/heptio/contour

$ make check
go install -mod=readonly -v -tags "oidc gcp" github.com/heptio/contour/cmd/contour
go: updates to go.sum needed, disabled by -mod=readonly
Makefile:35: recipe for target 'install' failed

@davecheney davecheney changed the title cmd/go: module project without go.sum file in repo cannot be built cmd/go: module project cannot update go.sum file in readonly mode Sep 4, 2019

@davecheney davecheney referenced this issue Sep 4, 2019
1 of 1 task complete
@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

This change was an intentional bug-fix: see #25530 (comment) and #30667.

-mod=readonly is typically used in CI systems, and the expectation is that users will build the program locally (or run go mod tidy) before pushing to CI, either of which will populate the relevant entries in go.sum.

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

Could you share more detail about your use-case for using -mod=readonly with an incomplete go.mod go.sum file?

@bcmills bcmills added this to the Go1.14 milestone Sep 4, 2019

@davecheney

This comment has been minimized.

Copy link
Contributor Author

commented Sep 4, 2019

@zikaeroh

This comment has been minimized.

Copy link

commented Sep 4, 2019

If the behavior difference is purely that 1.12 would create a go.sum if not present with -mod=readonly specified, and 1.13 doesn't, then it might be noteworthy that the repo linked in the issue has go.sum in its .gitignore, so it wouldn't exist in a fresh checkout or CI and would now fail with -mod=readonly regardless of go.mod's completeness.

@davecheney

This comment has been minimized.

Copy link
Contributor Author

commented Sep 4, 2019

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

(Sorry, I typo'd go.mod in place of go.sum in my earlier reply.)

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

The purpose of the go.sum file is to ensure that all developers resolve the same versions to the same code. It only fulfills that purpose if it is checked in.

If the developers have run tests in all applicable configurations, or have run go mod tidy, then the go.sum file should only change if there is a corresponding code change that adds an import of a previously-unused package. If you are seeing otherwise, please file an issue with steps to reproduce.

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

A go.sum file is not strictly required, just as a complete go.mod file is not strictly required — in both cases, the go command will fill in the missing information as it runs. However, -mod=readonly explicitly requests that the go command not fill in missing information.

@jayschwa

This comment has been minimized.

Copy link
Contributor

commented Sep 4, 2019

I have encountered a similar issue. go mod tidy from Go 1.13 places fewer lines in go.mod and go.sum than Go 1.12.9. As a result, our CI that runs Go 1.12.9 fails with cannot update go.sum in readonly mode. For now, we will use the Go 1.12.9 variant of go.sum as our source of truth in version control (until we switch our CI and prod stack to 1.13).

I'm not sure why the different Go versions produce different go.mod and go.sum files. Perhaps one of our dependencies is doing different things via version-specific build tags.

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 4, 2019

@jayschwa, the difference in go mod tidy behavior is likely due to the fix for #31248.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants
You can’t perform that action at this time.