proposal: cmd/go: error out of go mod download if the go.mod file is inconsistent #64008
Description
In Go 1.11, most go subcommands updated the go.mod file implicitly whenever it was found to be inconsistent. Starting in Go 1.16, we changed the default to -mod=readonly, which caused commands other than the go mod subcommands to instead error out if changes are needed to the go.mod or go.sum file.
However, go mod subcommands continued to update go.mod files until #45551 (in Go 1.18), and go mod download is still the command that we use to add checksums to the go.sum file, especially as a workaround for issues like #56222.
#45551 suggested that:
go mod downloadalways loads the build list and reports an error ifgo.modneeds to be updated instead of updating it automatically.go mod downloadonly adds a hash togo.sumif the corresponding module is explicitly named on the command line (not simply matched byallor a wildcard or implied by a lack of arguments) without an explicit version or at the version in the build list.
Unfortunately, that part of the issue was not implemented, and I don't recall why. (Perhaps @jayconrod or @matloob remembers? I wonder if it was blocked on a decision on #44435.)
Given #44435, I propose that we make a similar change as to what was suggested in #45551, but perhaps a little simpler:
go mod downloadshould report an error if it needs to load thego.modfile and finds that it needs to be updated.go mod downloadwithout arguments should report an error of thego.sumfile omits any checksum needed to compute the module graph or needed for one of the modules to be downloaded (from the set of modules defined in cmd/go: narrow 'mod download' default set #44435).go mod downloadwith explicit arguments should save checksums for each module that matches an argument that does not have an explicit version suffix.