go.sum has invalid imports from vanity urls

[adamdecaf]

Terraform Version

terraform v0.12.3

Expected Behavior

Inside a project where we want to include Terraform packages (e.g. helper/schema) go get commands should work.

Actual Behavior

Terraform's go.sum file contains invalid entries from vanity urls (in this case github.com/golang/lint rather than golang.org/x/lint)

Additional Context

Even a simple go.mod file fails to properly vendor from v0.12.3. Example

There's at lease one other import path that fails here:

go: sourcegraph.com/sourcegraph/go-diff@v0.5.1: parsing go.mod: unexpected module path "github.com/sourcegraph/go-diff"

Example CI build failure: https://travis-ci.org/adamdecaf/namecheap/jobs/549940867

[jbardin]

Hi @adamdecaf,

I believe the issue there is due to an old version of go. The release builds correctly as a module with go1.12.6. Could you try a current version of go and see is it resolves the problem?

[adamdecaf]

I tried with Go 1.12.6 and it's still failing for me. https://travis-ci.org/adamdecaf/namecheap/builds/549975672

Edit: Were you talking about go.sum being generated by Go 1.12.6? I don't see Modules related changes in the milestone, and I don't know what version generated Terraform's go.sum.

[jbardin]

There has been some flux in how checksums were calculated in recent versions of go, so that is often the cause of a sum mismatch. Since this is only triggered using go get -u, it also seems likely that upgrading a dependency is what is causing this.

It may still be the case that a module generated with and older version of go is at fault, but I'm not seeing where immediately. It does look like it's coming from a transitive dependency of some sort, and we need to track that down to try and reduce the scope of the issue.

[jbardin]

Ah, sorry, I was seeing a different sum related error when I tried to replicate this, but you're right, it looks like it is a module related error.

unexpected module path is usually something importing a package by the incorrect path, and upgrading all modules with go get -u is pulling in something different (likely a package recently adding a go.mod).

[adamdecaf]

On Terraform master in vendor/ I see these two projects pulling in github.com/golang/lint

File: github.com/hashicorp/go-getter/go.sum
34:1:github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=

File: github.com/googleapis/gax-go/v2/go.sum
5:1:github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=

One project pulls this in

File: github.com/hashicorp/go-getter/go.sum
181:1:sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=

[adamdecaf]

I traced this down somewhat. Terraform pulls in go-getter, which has github.com/golang/lint

• https://github.com/hashicorp/go-getter/blob/master/go.sum#L34

This seems to come from two dependencies:

• https://github.com/googleapis/gax-go/blob/master/go.sum#L7
• https://github.com/grpc/grpc-go/blob/v1.16.0/go.mod#L7
  • https://github.com/grpc/grpc-go/blob/v1.16.0/go.sum#L7-L8

Could the fix be in upgrading grpc? I assume that's a large change within Terraform, but the explicit go.mod entry seems to be carried through here.

GRPC's v1.18.0 release looks to be the first without the github.com/golang/lint entry, so Terraform wouldn't need to fully upgrade.

• https://github.com/grpc/grpc-go/blob/v1.18.0/go.mod
• v1.17.0 changelog and v1.18.0 changelog

[jbardin]

This should be fixed with updated modules and go version.
Since the go.sum file is solely generated by the go tool, the contents are mostly out of our control.
Feel free to reply if this is still an issue, but closing it out for now.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.