Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: "go mod why" doesn't explain some go.sum entries #52196

Closed
bradfitz opened this issue Apr 7, 2022 · 3 comments
Closed

cmd/go: "go mod why" doesn't explain some go.sum entries #52196

bradfitz opened this issue Apr 7, 2022 · 3 comments
Labels
FrozenDueToAge

Comments

@bradfitz
Copy link
Contributor

bradfitz commented Apr 7, 2022 •
edited

Our go.sum has an entry that go mod tidy doesn't delete and go mod why doesn't explain.

The tailscale.com module (https://github.com/tailscale/tailscale) at git rev c79c72c4fce75a37061d37b6b18e018e8a70b255:

$ go version
go version go1.18 linux/amd64
$ go mod tidy
$ git diff
$ git grep jwt
go.sum:github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
$ go mod why github.com/dgrijalva/jwt-go
# github.com/dgrijalva/jwt-go
(main module does not need package github.com/dgrijalva/jwt-go)
$ find . -name go.mod
./go.mod

It's likely we're confused about something but it seems like either go mod why or go mod tidy should do something differently? Several of us are confused enough to file a bug.

If this is working as intended, feature request: go mod why --sum-too
@mvdan
Copy link
Member

mvdan commented Apr 7, 2022

@bradfitz did you mean to use go mod why -m? go mod why works on packages and go.sum lists modules.

@cespare
Copy link
Contributor

cespare commented Apr 7, 2022

@mvdan same result:

$ go mod why -m github.com/dgrijalva/jwt-go
# github.com/dgrijalva/jwt-go
(main module does not need module github.com/dgrijalva/jwt-go)

@bradfitz I believe this is essentially #27900.

From looking at the output of go mod graph it looks like the paths that reach github.com/dgrijalva/jwt-go include various versions of these modules:

github.com/spf13/viper
go.etcd.io/etcd
github.com/google/certificate-transparency-go
github.com/google/trillian
github.com/mozilla/tls-observatory
github.com/securego/gosec/v2

/cc @bcmills

@bcmills
Copy link
Contributor

bcmills commented Apr 7, 2022

Duplicate of #27900

@bcmills bcmills marked this as a duplicate of #27900 Apr 7, 2022
@bcmills bcmills closed this as completed Apr 7, 2022
@golang golang locked and limited conversation to collaborators Apr 7, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@bradfitz @cespare @mvdan @bcmills @gopherbot