In CL 502015, I noticed a longstanding problem with the way cmd/go determines which checksums need to be saved in the go.sum file. Namely, the keepSums helper function assumes that a module's checksum is needed if:
- the module's checksum was consulted in the course of executing the command, and
- the module is the selected version of its path in the module graph.
That may have been true originally, but it's a very fragile assumption especially given module graph pruning and lazy module loading. In particular, commands like go get and go list -u -m all may download module contents or go.mod files in order to compute their output, even when those inputs are not otherwise relevant and do not result in any persistent changes to the module's requirements.
For now, we allow those extra checksums to be recorded and rely on go mod tidy to clean them up again later, but it would be better still not to record the irrelevant checksums in the first place. To do that, we probably need to make go get and go mod download more explicit about which modules they want to save, and make everything else less aggressive about saving checksums for modules in the build list.
See previously:
In CL 502015, I noticed a longstanding problem with the way
cmd/godetermines which checksums need to be saved in thego.sumfile. Namely, thekeepSumshelper function assumes that a module's checksum is needed if:That may have been true originally, but it's a very fragile assumption especially given module graph pruning and lazy module loading. In particular, commands like
go getandgo list -u -m allmay download module contents orgo.modfiles in order to compute their output, even when those inputs are not otherwise relevant and do not result in any persistent changes to the module's requirements.For now, we allow those extra checksums to be recorded and rely on
go mod tidyto clean them up again later, but it would be better still not to record the irrelevant checksums in the first place. To do that, we probably need to makego getandgo mod downloadmore explicit about which modules they want to save, and make everything else less aggressive about saving checksums for modules in the build list.See previously:
go getarguments and tests of external dependencies [1.20 backport] #60001