What version of Go are you using (go version)?

$ go version
go version go1.12.7 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/user/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/user/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build824852661=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Using type types.Config.Check() on a file importing a package with go.mod but without go.sum causes an attempt to write the missing go.sum file. I realize not having go.sum is a mistake on the repo maintainer side, but there are projects like that out there and they're used. This in turns causes problems in applications that depend on the type-checker to find out some information about source code (e.g. ObjectBox code generator).

See https://github.com/vaind/go-type-checker-issues for a minimal example that shows the issue. Try running the following code as a non-root user on linux:

$ git clone git@github.com:vaind/go-type-checker-issues.git
$ cd go-type-checker-issues/gosum
$ go test ./...
--- FAIL: TestGoSumPermissions (0.71s)
    gosum_test.go:39: gosum.go:5:4: could not import github.com/anacrolix/missinggo (type-checking package "github.com/anacrolix/missinggo" failed (/home/user/go/pkg/mod/github.com/anacrolix/missinggo@v0.0.0-20180725070939-60ef2fbf63df/strcase.go:6:2: could not import github.com/huandu/xstrings (go/build: importGo github.com/huandu/xstrings: exit status 1
        go: writing go.sum: open /home/user/go/pkg/mod/github.com/anacrolix/missinggo@v0.0.0-20180725070939-60ef2fbf63df/go.sum439740474.tmp: permission denied
        
        )))
FAIL
FAIL	github.com/vaind/go-type-checker-issues/gosum	0.711s

Interestingly a combination of go get & go test works fine, but unfortunately that doesn't solve the problem if you have such imports in your own project...

What did you expect to see?

I expect the type checker wouldn't try to create a missing go.sum file.