Related Issues

• x/exp/cmd/gorelease: unexpected go.sum complaint #64051 (closed)
• cmd/go: in go 1.21 module, go mod tidy and 'go list -m -u all' disagree over which go.sum lines are needed #61605
• cmd/go: mod tidy result different from previous go version #47847 (closed)
• cmd/go: `go mod tidy` and `go mod download` don't agree on same go.sum file. #44441 (closed)
• proposal: cmd/go: make go get leave go.sum in a tidy state #49300 (closed)
• cmd/go: mod tidy leaves go.sum inconsistent after module upgrade #47738 (closed)
• cmd/go: document different ways go.sum is populated #29492
• cmd/go: go mod tidy misses adding certain lines to go.sum #28129 (closed)
• x/exp/cmd/gorelease returns error: "go: updates to go.sum needed, disabled by -mod=readonly" #61022 (closed)
• cmd/go: 'go mod tidy' retains sums for modules in the requirement graph but not the build list #39424 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

This is against a private internal repo, so can share anything about that.

More information would really help for progress on this. Like a minimized reproducer or an anonymized go.sum file could really help. The contents of the variables in the gorelease.go line:

		if !sumsMatchIgnoringPath(string(goSumData), string(newGoSumData), modPath) {

would also be useful.

@timothy-king How to produce the info you need, anonymized go.sum?
Not sure I follow the contents of the variables in the gorelease.go, do you mean to bring that up in the debugger and see what those vars are?

I would just printf those values when the diagnostic is being created. But debugger also works. Hopefully those lines will tell us something interesting about what the failure is and hint at the next steps to take.

Right now all we really know is that this line is being reached. I am hoping to try to work backwards from that.

@timothy-king Looks like this is related to the go.mod having a directive like this:
replace github.com/golang-jwt/jwt/v4 => github.com/golang-jwt/jwt/v4 v4.5.1

for this requirement:
require github.com/golang-jwt/jwt/v4 v4.5.1 // indirect

The diff in the go.sum file is:
github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=

It's pulling in the unwanted jwt version in the go replace case.

Added this to gorelease.go to make easy to debug, in case you want to add something like that for future debugging.

		if !sumsMatchIgnoringPath(string(goSumData), string(newGoSumData), modPath) {
			diagnostics = append(diagnostics, "go.sum: one or more sums are missing. Run 'go mod tidy' to add missing sums.")
			diagnostics = append(diagnostics, "goSumData")
			diagnostics = append(diagnostics, string(goSumData))
			diagnostics = append(diagnostics, "newGoSumData")
			diagnostics = append(diagnostics, string(newGoSumData))
			diagnostics = append(diagnostics, "modPath")
			diagnostics = append(diagnostics, modPath)
		}

@seankhliao What other info are you waiting for, seems like obvious bug in the code related to the replace directive.

I don't think that's sufficient information for us to reproduce or identify the issue.

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)