cmd/go: missing sum after updating a different package #44129
Description
What version of Go are you using (go version)?
$ go version go version go1.16rc1 darwin/amd64
Does this issue reproduce with the latest release?
yes
What operating system and processor architecture are you using (go env)?
go env Output
GO111MODULE="" GOARCH="amd64" GOBIN="" GOCACHE="/Users/jayconrod/Library/Caches/go-build" GOENV="/Users/jayconrod/Library/Application Support/go/env" GOEXE="" GOFLAGS="" GOHOSTARCH="amd64" GOHOSTOS="darwin" GOINSECURE="" GOMODCACHE="/Users/jayconrod/go/pkg/mod" GONOPROXY="" GONOSUMDB="" GOOS="darwin" GOPATH="/Users/jayconrod/go" GOPRIVATE="" GOPROXY="https://proxy.golang.org,direct" GOROOT="/opt/go/installed" GOSUMDB="sum.golang.org" GOTMPDIR="" GOTOOLDIR="/opt/go/installed/pkg/tool/darwin_amd64" GOVCS="" GOVERSION="go1.16rc1" GCCGO="gccgo" AR="ar" CC="clang" CXX="clang++" CGO_ENABLED="1" GOMOD="/Users/jayconrod/Code/test/go.mod" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config" GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/rq/x0692kqj6ml8cvrhcqh5bswc008xj1/T/go-build528761276=/tmp/go-build -gno-record-gcc-switches -fno-common"
What did you do?
# Populate go.sum
go mod tidy
# Update a transitive dependency
go get -d google.golang.org/protobuf/proto
# Build package in main module
go build
-- go.mod --
module use
go 1.15
require (
github.com/gogo/status v1.1.0
google.golang.org/grpc v1.12.0
)
-- use.go --
package use
import (
_ "github.com/gogo/status"
_ "google.golang.org/grpc/codes"
)
What did you expect to see?
The package in the main module should still build after updating one of its transitive imports to a newer, compatible version.
What did you see instead?
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:37:2: missing go.sum entry for module providing package github.com/golang/protobuf/ptypes/any (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:38:2: missing go.sum entry for module providing package google.golang.org/genproto/googleapis/rpc/status (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:39:2: missing go.sum entry for module providing package google.golang.org/grpc/codes (imported by use); to add:
go get use
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:40:2: missing go.sum entry for module providing package google.golang.org/grpc/status (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
When I updated google.golang.org/protobuf/proto, it also updated the module github.com/golang/protobuf due to the minimum version required in google.golang.org/protobuf. However, github.com/golang/protobuf is not needed to build any package named on the command line, so go get didn't fetch its content or add a hash of its content to go.sum.
The module github.com/golang/protobuf is needed to build the package in the current directory, and since go.sum doesn't contain a hash for its selected version, go build fails.
A possible solution is that if go get changes the selected version of a module and there's a hash for the previous version in go.sum, go get should download the content of the newly selected version and add the hash to go.sum, possibly removing the hash for the previous version. This would make go get a bit slower, since it does more work. This won't prevent all errors, since the new version might import packages from other modules we don't have hashes for.