proposal: cmd/go: add GOSUMDBDIR to configure the location of downloaded checksum database files

[bcmills]

Over many years we've been trying to move to a state in which GOPATH/pkg is no longer needed (#4719, #34527).

However, it appears that when we added support for the checksum database (#25530), we did not also add a configuration point for the location of the local copy of the checksum database and transparency log. It is currently always located in GOPATH/pkg/sumdb:
https://cs.opensource.google/go/go/+/master:src/cmd/go/internal/cfg/cfg.go;l=422;drc=8fce59eab5cb2facfafca89e047b4b43ba44785f

For consistency, I think we should add such a configuration point as an environment variable akin to GOMODCACHE.

I suggest either GOSUMDBDIR (analogous to GOTMPDIR) or GOSUMDBCACHE (analogous to GOMODCACHE).

(CC @rsc @matloob @golang/tools-team)

[mvdan]

Can we not store this inside GOMODCACHE? It is cached information that was fetched about Go modules, after all. I'm not sure that users will see a benefit in keeping the directories and env vars separate.

[bcmills]

It isn't in GOMODCACHE today.

There is a moderate security benefit from not clearing the transparency log when one runs go clean -modcache, but I suspect that if we just special-cased “don't clear the tree head” that would probably be fine. 🤷‍♂️

[mvdan]

I understand the directories aren't merged today - I mean to say that we could join them and sidestep the need for GOSUMDBCACHE :) Go already has two "cache" env vars, which many users are confused by, so I'd love to avoid a third. Nearly as much as I'd love to get rid of my GOPATH directory.

[mvdan]

I ran into this again today; in a docker environment, I set GOCACHE and GOMODCACHE to mounted volumes to persist them, and HOME=/no-home (with GOPATH unset) to ensure that nothing else was leaking. I got errors in a go mod tidy command, as it was trying to create files under /no-home/go/pkg/sumdb:

go: github.com/protocolbuffers/txtpbfmt@v0.0.0-20230328191034-3462fbc510c0: verifying go.mod: github.com/protocolbuffers/txtpbfmt@v0.0.0-20230328191034-3462fbc510c0/go.mod: open /no-home/go/pkg/sumdb/sum.golang.org/latest: no such file or directory

I had forgotten about my suggestion above already, but I still stand by it. As an end user, I don't see any reason to split the sumdb cache from GOMODCACHE. If anything, it would be an extra bother to set up a third env var :)

[srdfjy]

I also want to move the path of gopath/pkg/sumdb to the go mod directory, but I can't find a way to make this change.