cmd/go: go mod verify does not verify modules with replace directive

[nicholashusin]

This came in as a security report originally (http://b/522253058 internally). But, we don't really see a practical way to exploit this. Therefore, classifying this is a public security hardening bug, rather than a vulnerability.

---

When a module is replaced in go.mod like so:

module example.com

go 1.26

require rsc.io/quote v1.5.2

replace rsc.io/quote v1.5.2 => rsc.io/quote v1.5.1

go mod verify fails to verify the replaced module, even if the local cached version has been modified.

[gabyhelp]

Related Issues

• cmd/go: mod verify tries to download replaced dependency #49118
• cmd/go: go mod verify reports "all modules verified" in auto mode #31974 (closed)
• `go mod verify` should consider the vendor directory instead of only the modules cache #48420 (closed)
• cmd/go: `replace` directive causes unexpected changes to module sums and vendored packages #40119 (closed)
• cmd/go: does not verify existence of replace directory #28032
• cmd/go: 'go list -mod=readonly' erroneously resolves imports from replaced modules #41577 (closed)
• cmd/go: 'mod verify' should not modify the go.mod file #31372 (closed)
• cmd/go: allow replacement version to be omitted if the target module has a required version #28176
• cmd/go: `go mod verify` seems to be confused by go.work files #65825 (closed)
• cmd/go: emit an error in 'go mod vendor' if any replacement is in the vendor directory #29169 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}