Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: cmd/go: error out of go mod download if the go.mod file is inconsistent #64008

bcmills opened this issue Nov 8, 2023 · 1 comment


Copy link

bcmills commented Nov 8, 2023

In Go 1.11, most go subcommands updated the go.mod file implicitly whenever it was found to be inconsistent. Starting in Go 1.16, we changed the default to -mod=readonly, which caused commands other than the go mod subcommands to instead error out if changes are needed to the go.mod or go.sum file.

However, go mod subcommands continued to update go.mod files until #45551 (in Go 1.18), and go mod download is still the command that we use to add checksums to the go.sum file, especially as a workaround for issues like #56222.

#45551 suggested that:

  • go mod download always loads the build list and reports an error if go.mod needs to be updated instead of updating it automatically.
  • go mod download only adds a hash to go.sum if the corresponding module is explicitly named on the command line (not simply matched by all or a wildcard or implied by a lack of arguments) without an explicit version or at the version in the build list.

Unfortunately, that part of the issue was not implemented, and I don't recall why. (Perhaps @jayconrod or @matloob remembers? I wonder if it was blocked on a decision on #44435.)

Given #44435, I propose that we make a similar change as to what was suggested in #45551, but perhaps a little simpler:

  • go mod download should report an error if it needs to load the go.mod file and finds that it needs to be updated.
  • go mod download without arguments should report an error of the go.sum file omits any checksum needed to compute the module graph or needed for one of the modules to be downloaded (from the set of modules defined in cmd/go: narrow 'mod download' default set #44435).
  • go mod download with explicit arguments should save checksums for each module that matches an argument that does not have an explicit version suffix.
@bcmills bcmills added this to the Proposal milestone Nov 8, 2023
Copy link

Change mentions this issue: cmd/go: allow toolchain upgrades in 'go mod download' when we would already allow go.mod updates

gopherbot pushed a commit that referenced this issue Nov 8, 2023
…lready allow go.mod updates

This fixes an inconsistency that was introduced in CL 537480 and noted
in the review on CL 539697.

In particular, 'go mod download' already updates the go.mod file when
other kinds of updates are needed. (#45551 suggested that it should
not do so, but that part of the change was not implemented yet;
finishing that change is proposed as #64008.)

Updates #62054.

Change-Id: Ic659eb8538f4afdec0454737e982d42ef8957e56
Auto-Submit: Bryan Mills <>
LUCI-TryBot-Result: Go LUCI <>
Reviewed-by: Michael Matloob <>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Status: Incoming

No branches or pull requests

2 participants