Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: go mod download adds unnecessary entries to go.sum #45332

Open
aofei opened this issue Apr 1, 2021 · 3 comments
Open

cmd/go: go mod download adds unnecessary entries to go.sum #45332

aofei opened this issue Apr 1, 2021 · 3 comments

Comments

@aofei
Copy link
Contributor

@aofei aofei commented Apr 1, 2021

What version of Go are you using (go version)?

$ go version
go version go1.16.2 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN="/home/aofei/bin"
GOCACHE="/home/aofei/.cache/go-build"
GOENV="/home/aofei/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/aofei/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/aofei/go"
GOPRIVATE=""
GOPROXY="https://goproxy.cn,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.2"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1210455100=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ git clone -b v1.1.5 https://github.com/aofei/sandid.git
$ cd sandid
$ go mod download
$ git diff
diff --git a/go.sum b/go.sum
index c221f64..ec9d676 100644
--- a/go.sum
+++ b/go.sum
@@ -3,6 +3,7 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
$ go mod tidy
$ git status
Not currently on any branch.
nothing to commit, working tree clean

What did you expect to see?

I expect to see that go mod download doesn't change anything. Or, at least it shouldn't fight with go mod tidy.

What did you see instead?

It adds unnecessary entries to go.sum.


A possible solution is to modload.TrimGoSum before modload.WriteGoMod(ctx).

Or, maybe go mod download shouldn't update go.mod or go.sum at all. Maybe people just expect it to fill the local cache. So another possible solution is to remove modload.WriteGoMod(ctx).

@jayconrod @bcmills @matloob

@aofei
Copy link
Contributor Author

@aofei aofei commented Apr 1, 2021

@gopherbot, please add labels GoCommand, modules

@jayconrod
Copy link
Contributor

@jayconrod jayconrod commented Apr 1, 2021

This was an intentional change in 1.16, but I don't think we should close this issue unless we're sure this is the behavior we want.

Previously, go mod download update go.mod and go.sum after loading the build list, but it didn't update go.sum after downloading modules. It seems like it should do both or neither (like -mod=readonly or -mod=mod essentially, though go mod download does not accept the -mod flag).

One particular problem we were trying to solve: with the switch to -mod=readonly was that in some cases, you need the sum for a module's content, even if you don't need any packages from it. That happens when a module in the build list has a path that's a prefix of another module. When the go command loads a package from one, it needs to confirm the package is not also in the other. For example, the package example.com/a/b could be in either module example.com/a or example.com/a/b, and we need to load both to be sure.

If one of the sums is missing, we need a command more focused than go mod tidy to add the sum. go mod download example.com/a does that now.

We've gotten a fair amount of feedback that this isn't what people expect when running go mod download without arguments. go mod download doesn't load the package graph, so it doesn't know whether go mod tidy would keep a sum or not. Maybe it just shouldn't write go.sum unless a specific module is requested.

@jayconrod jayconrod modified the milestones: go1.17, Go1.17 Apr 1, 2021
@jayconrod
Copy link
Contributor

@jayconrod jayconrod commented Apr 1, 2021

Incidentally, until this issue is resolved, I'd recommend go list -test -deps ./... instead of go mod download for populating the module cache.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants