Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: go build -mod=readonly should disallow go.sum updates #30667

Closed
rsc opened this issue Mar 8, 2019 · 2 comments
Closed

cmd/go: go build -mod=readonly should disallow go.sum updates #30667

rsc opened this issue Mar 8, 2019 · 2 comments
Labels
FrozenDueToAge modules NeedsFix The path to resolution is known, but the work has not been done. release-blocker
Milestone

Comments

@rsc
Copy link
Contributor

rsc commented Mar 8, 2019

go build -mod=readonly disallows go.mod updates.
It should also disallow go.sum updates.
Maybe it already does; I haven't checked.

@marwan-at-work
Copy link
Contributor

can confirm that -mod=readonly does not disallow go.sum updates.

go mod init reproduce 
go get github.com/pkg/errors
echo "" > go.sum
go build -mod=readonly

@gopherbot
Copy link

Change https://golang.org/cl/166237 mentions this issue: cmd/go: disallow go.sum updates in -mod=readonly

@bcmills bcmills added the NeedsFix The path to resolution is known, but the work has not been done. label Mar 28, 2019
anoadragon453 added a commit to matrix-org/dendrite that referenced this issue Jul 12, 2019
Every time before sending a PR I like to run ./scripts/build-test-lint.sh to make sure the CI won't complain about anything.

The problem is that this script attempts to install golangci-lint, which causes modifications to go.mod/go.sum. This PR backs up and restores those files before and after linting.

Ideally instead of this hacky backing up/restoring we'd use go gets -mod=readonly option, but that still modifies go.sum. This will be fixed in go 1.13 apparently. golang/go#30667
davecheney added a commit to davecheney/contour that referenced this issue Sep 5, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Sep 5, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to projectcontour/contour that referenced this issue Sep 5, 2019
Fixes #1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to davecheney/contour that referenced this issue Oct 3, 2019
Fixes projectcontour#1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
davecheney added a commit to projectcontour/contour that referenced this issue Oct 3, 2019
Fixes #1377

BREAKING CHANGE

We build with -mod=readonly so that the build will fail if anything is
out of date in our go.mod file. golang/go#30667 changed the behaviour of
the go tool to require that go.mod AND go.sum be up to date so this
means I cannot use my hack of .gitignoring the go.sum file.

This means when you pull this commit you will probably have to delete
your local go.sum working copy. If we're lucky then you shouldn't need
to change it after that. If we're not lucky, the bloody thing will
always be dirty and we'll waste a lot of time telling people to revert
their changes to this file. C'est la vie.

Signed-off-by: Dave Cheney <dave@cheney.net>
@golang golang locked and limited conversation to collaborators May 13, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge modules NeedsFix The path to resolution is known, but the work has not been done. release-blocker
Projects
None yet
Development

No branches or pull requests

5 participants