What version of Go are you using (go version)?

go version go1.10 linux/amd64 vgo:2018-02-20.1

What operating system and processor architecture are you using (go env)?

linux amd64

What did you do?

I ran vgo build after importing a dependency into my module.

What did you expect to see?

I expected vgo build to checkout the dependency into a location, and set permissions on the files checked out that correspond to the intended use of those files. The files are clearly marked as being the files matching 9d5d1c7387b7 which signals that they should not be changed.

~/go/src/v/4d63.com/biblepassageapi@v0.0.0-20180105044528-9d5d1c7387b7 
$ ls -lah
total 40K
drwxr-xr-x 2 root root 4.0K Feb 25 06:17 .
drwxr-xr-x 9 root root 4.0K Feb 21 07:08 ..
-r--r--r-- 1 root root 3.6K Feb 25 05:54 bible_biblesorg.go
-r--r--r-- 1 root root 1.8K Feb 21 05:46 bible_esvapi.go
-r--r--r-- 1 root root  171 Feb 21 05:46 bible.go
...

What did you see instead?

vgo build setup the dependency at the location in the GOPATH with the files not marked as read-only.

~/go/src/v/4d63.com/biblepassageapi@v0.0.0-20180105044528-9d5d1c7387b7 
$ ls -lah
total 40K
drwxr-xr-x 2 root root 4.0K Feb 25 06:17 .
drwxr-xr-x 9 root root 4.0K Feb 21 07:08 ..
-rw-r--r-- 1 root root 3.6K Feb 25 05:54 bible_biblesorg.go
-rw-r--r-- 1 root root 1.8K Feb 21 05:46 bible_esvapi.go
-rw-r--r-- 1 root root  171 Feb 21 05:46 bible.go
...

Why should they be marked as read-only

The Go community, and myself, are accustomed to editing Go packages where they are checked out in the GOPATH. With vgo this is now not appropriate. The correct use is to manually checkout the project at another path and add a replace directive.

Setting the file permissions of files checked out in the special vgo path communicates that intent and catches edits developers may make when their IDE automatically loads the file at that location during reference searches and the developer starts making changes to it. Most IDEs will warn that the developer is editing a read-only file and that will hopefully trigger the developer to checkout the project and setup the replace directive so they can develop on the main mod and the dependency mod correctly.

A fix

I'd like to take a stab at making the fix for this.