Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: 'go mod tidy' should retain go.sum entries for the module graph with and without replacements #29182

Closed
bcmills opened this issue Dec 12, 2018 · 3 comments
Closed

cmd/go: 'go mod tidy' should retain go.sum entries for the module graph with and without replacements #29182

bcmills opened this issue Dec 12, 2018 · 3 comments
Labels
FrozenDueToAge modules NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Backlog

Comments

@bcmills
Copy link
Contributor

bcmills commented Dec 12, 2018

Today, go mod tidy trims go.mod and go.sum to just what is needed when building the main module as viewed from inside that module.

However, in many cases users of the module will build from outside that module (especially given #24250). Builds from outside may need additional modules to satisfy the imports as seen from outside, and may need to check sums for those additional modules as well (see #28802).

go mod tidy should ensure that both views of the module are complete and reproducible. That is, it should include enough requirements to satisfy the transitive import graph in both views (and regardless of build tags).

(A flag to compute only the outside view, as in #24666, would not suffice: go mod tidy using only an outside view could lead to missing requirements for builds from inside the module.)
@bcmills bcmills added this to the Go1.13 milestone Dec 12, 2018
@bcmills bcmills mentioned this issue Dec 21, 2018
Closed
This was referenced Mar 28, 2019
Closed
Closed
@andybons andybons modified the milestones: Go1.13, Go1.14 Jul 8, 2019
@rsc rsc modified the milestones: Go1.14, Backlog Oct 9, 2019
@jtlisi jtlisi mentioned this issue Jul 8, 2020
Closed
@jtlisi
Copy link

jtlisi commented Jul 8, 2020

@bcmills Is there a recommended workaround when encountering this issue? Is the best recourse to abuse the replace directive even further?

@bcmills bcmills added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 20, 2020
@bcmills
Copy link
Contributor Author

bcmills commented Jul 20, 2020

@jtlisi, this issue is probably less relevant now that #28802 is withdrawn: the go.sum file for the main module is only used when inside that module, so it probably suffices for it to only contain the checksum entries for the internal view of that module.

@bcmills
Copy link
Contributor Author

bcmills commented Sep 8, 2020

Thinking about this some more: users outside the module will not use its go.sum file at all, and users inside the module will always apply its replace directives. So the only go.sum lines we need to retain at the moment are the replacements themselves.

That may change if the set of replacements can vary without changing the go.mod file contents (such as if we adopt #26640 or similar), but for now I think go mod tidy only needs to retain sums for the main module's view of its own dependencies, with replacements already applied.

@bcmills bcmills closed this as completed Sep 8, 2020
@golang golang locked and limited conversation to collaborators Sep 8, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge modules NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests
5 participants
@rsc @andybons @bcmills @jtlisi @gopherbot