Doesn't work

[pjebs]

Your site doesn't seem to work for https://github.com/rocketlaunchr/dataframe-go

[siggy]

dataframe-go repo is missing go.sum:

$ go install github.com/loov/goda@v0.4.3
$ git clone https://github.com/rocketlaunchr/dataframe-go
$ cd dataframe-go
$ goda graph -short -cluster ./...
go [-e -json -compiled=true -test=false -export=false -deps=true -find=false -- ./...]: exit status 1: go: cloud.google.com/go@v0.57.0: missing go.sum entry; to add it:
	go mod download cloud.google.com/go
go: cloud.google.com/go@v0.57.0: missing go.sum entry; to add it:
	go mod download cloud.google.com/go

[pjebs]

You don't need a go.sum

[siggy]

https://github.com/golang/go/wiki/Modules#should-i-commit-my-gosum-file-as-well-as-my-gomod-file

[pjebs]

https://github.com/golang/go/wiki/Modules#is-gosum-a-lock-file-why-does-gosum-include-information-for-module-versions-i-am-no-longer-using

No, go.sum is not a lock file. The go.mod files in a build provide enough information for 100% reproducible builds

[siggy]

It's true go.sum is not necessary for builds, but that's like saying passwords are not necessary for websites. Yes you can technically set it up that way, but it's extremely ill advised from a security standpoint.

Two things per my first comment:

1. The failure you reported is coming from a mature Go ecosystem tool, goda, which itself gets the error from the golang/go repo, which (correctly) requires a go.sum when calling goModSummary:

   • https://github.com/golang/go/blob/45f45444b307cea7c8330b100b30382e642e010f/src/cmd/go/internal/modload/import.go#L713
   • https://github.com/golang/go/blob/45f45444b307cea7c8330b100b30382e642e010f/src/cmd/go/internal/modload/modfile.go#L589

2. If you just want a dependency graph of that repo, you can simply run the commands I provided in my first comment.

More info: https://go.dev/ref/mod#authenticating