cmd/go: confusing error message when `go list` is missing checksums for patterns outside the main module

[biohazduck]

What version of Go are you using (go version)?

$ go version
go version go1.19.3 linux/amd64

Does this issue reproduce with the latest release?

Probably?

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN="/home/pato/local/bin"
GOCACHE="/home/pato/.cache/go-build"
GOENV="/home/pato/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/pato/go/pkg/mod"
GONOPROXY="github.com/StammBio"
GONOSUMDB="github.com/StammBio"
GOOS="linux"
GOPATH="/home/pato/go"
GOPRIVATE="github.com/StammBio"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.19.3"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="/usr/bin/clang"
CXX="/usr/bin/clang++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3352220154=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Ran go list github.com/... in a repository and got

go: updates to go.mod needed; to update it:
        go mod tidy

Running go mod tidy did not fix it.

Here's a MWE:

package main

import (
	"golang.org/x/exp/slog"
	"periph.io/x/host/v3"
)

func main() {
	slog.Any("", "")
	host.Init()
}

Running go mod init tg gives me the following go.mod and go.sum

module tg

go 1.19

require (
	golang.org/x/exp v0.0.0-20230420155640-133eef4313cb
	periph.io/x/host/v3 v3.8.0
)

require periph.io/x/conn/v3 v3.7.0 // indirect

golang.org/x/exp v0.0.0-20230420155640-133eef4313cb h1:rhjz/8Mbfa8xROFiH+MQphmAmgqRM0bOMnytznhWEXk=
golang.org/x/exp v0.0.0-20230420155640-133eef4313cb/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
periph.io/x/conn/v3 v3.7.0 h1:f1EXLn4pkf7AEWwkol2gilCNZ0ElY+bxS4WE2PQXfrA=
periph.io/x/conn/v3 v3.7.0/go.mod h1:ypY7UVxgDbP9PJGwFSVelRRagxyXYfttVh7hJZUHEhg=
periph.io/x/host/v3 v3.8.0 h1:T5ojZ2wvnZHGPS4h95N2ZpcCyHnsvH3YRZ1UUUiv5CQ=
periph.io/x/host/v3 v3.8.0/go.mod h1:rzOLH+2g9bhc6pWZrkCrmytD4igwQ2vxFw6Wn6ZOlLY=

What did you expect to see?

A list of go modules

What did you see instead?

go: updates to go.mod needed; to update it:
        go mod tidy

[biohazduck]

Fixed a typo: I was running go list github.com/... not go list ./...

[seankhliao]

$ go mod why -m github.com/jonboulle/clockwork
# github.com/jonboulle/clockwork
tg
periph.io/x/host/v3
periph.io/x/host/v3/beagle/bone
periph.io/x/conn/v3/pin/pinreg
periph.io/x/conn/v3/pin/pinreg.test
periph.io/x/conn/v3/gpio/gpiotest
github.com/jonboulle/clockwork

so there's a module that's pruned out, does go just need a better error message in this case?

cc @bcmills

[bcmills]

Sounds like #56222, maybe?
(We can have a look to see if it's related.)

[bcmills]

Wait, no. go list github.com/... is wrong — don't run that! 🤦‍♂️

[bcmills]

In particular: go list github.com/... lists every package in every module in the module graph that begins with the prefix github.com/, even the ones that are normally not relevant. However, go.sum lists checksums for only the modules that are relevant to the dependencies of the main module.

If go list ./... or go list all don't work, that's a problem, but go list github.com/... missing checksums is expected.

[bcmills]

So, I agree with @seankhliao that the problem here is the error message.

We shouldn't say updates to go.mod needed, nor suggest go mod tidy, if the packages and/or patterns we're trying to load are outside of the main module.