What version of Go are you using (go version)?

$ go version
go version go1.11.4 darwin/amd64

Does this issue reproduce with the latest release?

1.11.4 is the latest release

What operating system and processor architecture are you using (go env)?

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/lukasz/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/lukasz/Go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/qs/6r1dd8md22bggtghnmmhlf9m0000gn/T/go-build246619765=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

This was noticed via renovatebot/renovate#3017, I didn't manage to find any details of what should be in go.sum.
go get -d populates go.sum file with different content if a dependency present in go.mod is used or not

Dependency used

go.mod:

module github.com/prymitive/test

require gopkg.in/yaml.v2 v2.2.2

main.go

package main

import _ "gopkg.in/yaml.v2"

func main() {}

Running go get creates a go.sum file:

$ GO111MODULE=on go get -d
$ cat go.sum
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

If I remove import _ "gopkg.in/yaml.v2" line from main.go so that it contains:

package main

func main() {}

Remove go.sum and re-run go get:

$ rm go.sum
$ GO111MODULE=on go get -d
$ cat go.sum
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

I'll get one line less in go.sum file (gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=).

What did you expect to see?

I expected go.sum to be created in a consistent way, which would help with reproducible builds.
Having documentation around it would help manage expectations around the behavior of how go.sum is populated under different scenarios.
One reason that know this is useful is that it was mentioned that go.sum is "kinda like a lockfile" and one should commit it to the vcs. Because it gets populated differently under different scenarios it's not clear to me when should I commit it. After reading that go mod tidy ensures that dependecies for all possible OS/arch combos are preset it seems to me that ideally one should commit go.sum only after running go mod tidy, otherwise some commands might generate local changes in that file.

What did you see instead?

go.sum is created with different content depending on which dependencies from go.mod are imported.