I think this is because go list -m all in 1.16 roughly equals go list -m -mod=readonly in 1.15. An alternative to adding -mod=mod would be to run go mod tidy to ensure go.mod and go.sum aren't missing any lines.

This is an expected consequence of #40728.

There are several ways to mitigate it:

• In the steps to reproduce, copy the project's go.sum file in addition to its go.mod file.
• Or, run go mod download, go mod tidy, or go mod vendor after copying in the go.mod file.
• Or, if you are copying the go.mod file in order to build some package, run go get -d on that package in order to fetch checksums for its dependencies.
• Or, pass -mod=mod explicitly to the go list command, to inform it that you really are ok with going out to the network to fetch checksums.

(CC @jayconrod @matloob)

@qbit: taking the above options into account, do you have a specific workflow that this workflow makes awkward or difficult?

(If so, we can look for other mitigations — or perhaps other changes to -mod=readonly mode, or better documentation — to address that workflow.)

In my case adding -mod=mod seems to be the best approach.

For context, this is for the OpenBSD portgen utility, which builds a port (think software packaging) of go tools. I am using go list -m all to get a list of all dependencies for inclusion in a port's distribution file list (for example, here is the distinfo file for the age port).

Thanks for the info!

Thanks! In that case, I'm going to close this as “worked as proposed in #40728”, but please do let us know if you run into other cases that can't easily be fixed.