"go mod download" dirties go.sum

[lmb]

This might be a problem with the Go toolchain, but I've not found a relevant bug yet.

Since d124590 I get the following (using go 1.16):

$ go mod download
lorenz@antares:~/dev/ebpf (master *)
$ git diff
diff --git a/go.sum b/go.sum
index 7f94146..781a610 100644
--- a/go.sum
+++ b/go.sum
@@ -4,6 +4,7 @@ github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pty v1.1.1 h1:VkoXIwSboBpnk99O/KFauAEILuNHv5DVFKZMBN/gUgw=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=

Running go mod tidy afterwards removes the entry again. This causes CI builds so (silently, due to another bug) fail.

[ti-mo]

This might be related to golang/go#43994, and seems to be happening across multiple Go projects.

[lmb]

Good find, thanks! So we can probably just call go mod tidy instead of go mod download?

[ti-mo]

I think go mod tidy should always be run right before committing go.sum to ensure it's in a minimal state. That's all I know. 😅

[aditighag]

Thanks for finding this issue.
+1 to @ti-mo's comment. I've been running go mod tidy or go mod vendor (when vendoring is enabled) to "sync" modules. I have this workflow automated in my IDE, but I didn't realize that our CI runs go mod download.

Edit: The official Go documentation for go mode download -

The go mod download command is useful mainly for pre-filling the module cache or for loading data to be served by a module proxy.

I think we still need this for the unit test step that I highlighted above?

In the CI, however, we need to check for duplicate/unused/missing dependencies.

go mod tidy ensures that the go.mod file matches the source code in the module. It adds any missing module requirements necessary to build the current module's packages and dependencies, and it removes requirements on modules that don't provide any relevant packages. It also adds any missing entries to go.sum and removes unnecessary entries.

This would be a new step in the workflow.

[aditighag]

Fixed by #232.