In CL 502015, I noticed a longstanding problem with the way cmd/go determines which checksums need to be saved in the go.sum file. Namely, the keepSums helper function assumes that a module's checksum is needed if:

1. the module's checksum was consulted in the course of executing the command, and
2. the module is the selected version of its path in the module graph.

That may have been true originally, but it's a very fragile assumption especially given module graph pruning and lazy module loading. In particular, commands like go get and go list -u -m all may download module contents or go.mod files in order to compute their output, even when those inputs are not otherwise relevant and do not result in any persistent changes to the module's requirements.

For now, we allow those extra checksums to be recorded and rely on go mod tidy to clean them up again later, but it would be better still not to record the irrelevant checksums in the first place. To do that, we probably need to make go get and go mod download more explicit about which modules they want to save, and make everything else less aggressive about saving checksums for modules in the build list.

See previously:

• cmd/go: missing checksums for dependencies of go get arguments and tests of external dependencies [1.20 backport] #60001
• cmd/go: go list fails with submodules which have test-only dependencies #60667