What version of Go are you using (go version)?

go1.20

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

darwin/arm64

What did you do?

Used https://pkg.go.dev/golang.org/x/mod@v0.10.0/zip#CreateFromVCS to create a zip file for a submodule to populate a file://-based goproxy directory.

The root of the repo contains a LICENSE file. The subdirectory for the submodule did not.

The produced zip file did not include the LICENSE file from the repo root. This differed from the zip file downloaded by modfetch once the revision was published, and meant the go.sum calculated pre-publish did not match.

The need to copy the LICENSE file from the repo root if the subdirectory did not contain a license was mentioned during review of the CreateFromVCS addition in https://go-review.googlesource.com/c/mod/+/330769:

Note that we also may need to copy the LICENSE file from the repository root, even if it's not in the module subdirectory.

So basically I think CreateFromVCS needs to:

• Given the repository root directory, detect the VCS tool in use.
• Extract code from cmd/go/internal/modfetch/codehost to run 'git archive' or something similar, writing to a temporary archive.
• Extract code from cmd/go/internal/modfetch.codeRepo.Zip to produce the correct list of Files. Maybe add LICENSE.

It doesn't look like that logic made it into the final version.