cmd/go: go run in module mode adds spurious modules to go.sum

eliasnaur commented 5 years ago

What version of Go are you using (`go version`)?

$ go version
go version devel +0212f0410f Thu Aug 15 17:49:11 2019 +0000 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/elias/Library/Caches/go-build"
GOENV="/Users/elias/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/elias/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/elias/go-tip"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/elias/go-tip/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/elias/scratch/go-root-module/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/_7/lnt35k555hl2bs7fjygkhgx00000gp/T/go-build854270208=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

$ mkdir go-root-module
$ cd go-root-module/
$ go mod init example.com
go: creating new go.mod: module example.com
$ go run gioui.org/cmd/gio
go: finding gioui.org latest
go: finding gioui.org/cmd latest
...
$ cat go.sum
gioui.org v0.0.0-20190822092511-9520a9278f4f h1:hZPDCKHXZUIJZ2W+FUYFjZXru4fyeG15l82jmNYI51Y=
gioui.org/cmd v0.0.0-20190822092511-9520a9278f4f
gioui.org/cmd v0.0.0-20190822092511-9520a9278f4f/go.mod h1:rn6q3wa1gugvIB50m0JxJ4krKQAfc0sQHJKvsuZW8+c=
...

What did you expect to see?

Only the two lines referring to module gioui.org/cmd.

What did you see instead?

A spurious line for gioui.org, which is not even a module, but rather the root repository for gioui.org/cmd.

jayconrod commented 5 years ago

When the Go command resolves gioui.org/cmd/gio to a module, it queries every prefix of that path in parallel and checks whether a package is present.

We need to verify the sums for these modules, but there's not really any point in saving sums for module zips that we don't end up using. We shouldn't add these to go.sum.

bcmills commented 5 years ago

Duplicate of #31580

golang / go