go: cmd/go: missing sum after updating a different package
What version of Go are you using (go version)?
$ go version go version go1.16rc1 darwin/amd64
Does this issue reproduce with the latest release?
yes
What operating system and processor architecture are you using (go env)?
go env Output
GO111MODULE="" GOARCH="amd64" GOBIN="" GOCACHE="/Users/jayconrod/Library/Caches/go-build" GOENV="/Users/jayconrod/Library/Application Support/go/env" GOEXE="" GOFLAGS="" GOHOSTARCH="amd64" GOHOSTOS="darwin" GOINSECURE="" GOMODCACHE="/Users/jayconrod/go/pkg/mod" GONOPROXY="" GONOSUMDB="" GOOS="darwin" GOPATH="/Users/jayconrod/go" GOPRIVATE="" GOPROXY="https://proxy.golang.org,direct" GOROOT="/opt/go/installed" GOSUMDB="sum.golang.org" GOTMPDIR="" GOTOOLDIR="/opt/go/installed/pkg/tool/darwin_amd64" GOVCS="" GOVERSION="go1.16rc1" GCCGO="gccgo" AR="ar" CC="clang" CXX="clang++" CGO_ENABLED="1" GOMOD="/Users/jayconrod/Code/test/go.mod" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config" GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/rq/x0692kqj6ml8cvrhcqh5bswc008xj1/T/go-build528761276=/tmp/go-build -gno-record-gcc-switches -fno-common"
What did you do?
# Populate go.sum
go mod tidy
# Update a transitive dependency
go get -d google.golang.org/protobuf/proto
# Build package in main module
go build
-- go.mod --
module use
go 1.15
require (
github.com/gogo/status v1.1.0
google.golang.org/grpc v1.12.0
)
-- use.go --
package use
import (
_ "github.com/gogo/status"
_ "google.golang.org/grpc/codes"
)
What did you expect to see?
The package in the main module should still build after updating one of its transitive imports to a newer, compatible version.
What did you see instead?
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:37:2: missing go.sum entry for module providing package github.com/golang/protobuf/ptypes/any (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:38:2: missing go.sum entry for module providing package google.golang.org/genproto/googleapis/rpc/status (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:39:2: missing go.sum entry for module providing package google.golang.org/grpc/codes (imported by use); to add:
go get use
../../go/pkg/mod/github.com/gogo/status@v1.1.0/status.go:40:2: missing go.sum entry for module providing package google.golang.org/grpc/status (imported by github.com/gogo/status); to add:
go get github.com/gogo/status@v1.1.0
When I updated google.golang.org/protobuf/proto, it also updated the module github.com/golang/protobuf due to the minimum version required in google.golang.org/protobuf. However, github.com/golang/protobuf is not needed to build any package named on the command line, so go get didn’t fetch its content or add a hash of its content to go.sum.
The module github.com/golang/protobuf is needed to build the package in the current directory, and since go.sum doesn’t contain a hash for its selected version, go build fails.
A possible solution is that if go get changes the selected version of a module and there’s a hash for the previous version in go.sum, go get should download the content of the newly selected version and add the hash to go.sum, possibly removing the hash for the previous version. This would make go get a bit slower, since it does more work. This won’t prevent all errors, since the new version might import packages from other modules we don’t have hashes for.
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 70
- Comments: 44 (22 by maintainers)
Links to this issue
Commits related to this issue
- staging/publishing: add -mod=mod for smoke tests for go1.16 With the move to go1.16, we are hitting a go bug for how `go build`/`go test` work with modules - golang/go#44129. This commit adds the `-... — committed to nikhita/kubernetes by nikhita 3 years ago
- Run "go mod tidy" and "make tools" For some reason "go mod tidy" breaks "make generate" unless "make tools" is executed afterwards. Possibly related to https://github.com/golang/go/issues/44129. — committed to boreq/velo by boreq 3 years ago
- go mod tidy Required to solve build failure. See https://github.com/golang/go/issues/44129 for the long-term issue about this. — committed to kubecost/kubectl-cost by michaelmdresser 3 years ago
- add go test -mod=mod option for go1.16 ref https://github.com/golang/go/issues/44129 — committed to eiicon-company/go-core by krrrr38 3 years ago
- go 1.16 (#11) * go 1.16 * make gomodule-upgrade * upgrade ci golang image to 1.16 * fix linter * add go test -mod=mod option for go1.16 ref https://github.com/golang/go/issues/44129 — committed to eiicon-company/go-core by krrrr38 3 years ago
- Use `go mod tidy` before make I have the issue with go 1.16 that I cannot build dapr because of a lot of errors with the message: ``` missing go.sum entry for module providing package ... ``` ... — committed to akkie/components-contrib by akkie 3 years ago
- Go 1.16 requires a go.sum file, generated by `go mod tidy` This commit adds a go.sum file generated by `go mod tidy` to the repo. Upstream issue: https://github.com/golang/go/issues/44129 — committed to ljrk0/hide.client.linux by ljrk0 3 years ago
- Update/add third party Update third party. It seems the tests need `-mod=mod` due to https://github.com/golang/go/issues/44129 the ones where this didn't fix it I've left untouched. — committed to klauspost/avo by klauspost 3 years ago
- tests/thirdparty: update/add packages, fix modules (#186) Update github.com/klauspost/compress version. Add github.com/klauspost/reedsolomon and github.com/minio/md5-simd. Add `-mod=mod` to com... — committed to mmcloughlin/avo by klauspost 3 years ago
- Use `go mod tidy` before make (#799) * Use `go mod tidy` before make I have the issue with go 1.16 that I cannot build dapr because of a lot of errors with the message: ``` missing go.sum ent... — committed to dapr/components-contrib by akkie 3 years ago
- rpm: Build fixes for v2.4.0 golang 1.16 changed behavior and now requires running `go mod tidy` after modifying go.mod. Running that works on golang 1.15 too, so we'll just run it everywhere. This ... — committed to caddyserver/dist by carlwgeorge 3 years ago
- Fix go1.16 go mod problem When we run: go get -u github.com/onsi/ginkgo/ginkgo && make lint it fails because of this bug: https://github.com/golang/go/issues/44129 running "go mod tidy" before `go ... — committed to epinio/epinio by deleted user 3 years ago
- Fix go1.16 go mod problem When we run: go get -u github.com/onsi/ginkgo/ginkgo && make lint it fails because of this bug: https://github.com/golang/go/issues/44129 running "go mod tidy" before `go ... — committed to epinio/epinio by deleted user 3 years ago
- Work around build breakage due to https://github.com/golang/go/issues/44129 — committed to cure/headscale by cure 3 years ago
- Work around build breakage due to https://github.com/golang/go/issues/44129 — committed to cure/headscale by cure 3 years ago
- Work around build breakage due to https://github.com/golang/go/issues/44129 — committed to cure/headscale by cure 3 years ago
- Work around build breakage due to https://github.com/golang/go/issues/44129 — committed to cure/headscale by cure 3 years ago
- Fix build breakage due to https://github.com/golang/go/issues/44129. The issue was that our build pipeline uses 'go get' call to install golint, which changed the go.mod/go.sum files (not good, but I... — committed to cure/headscale by cure 3 years ago
For anyone running into this issue in Go 1.16, you can use
go geton a package (or set of packages) in the main module. It will add requirements and sums for anything needed by those packages. In my example above, that would be:go mod tidywill also add requirements sums needed by all packages in the main module. It will also remove requirements and sums that aren’t needed anymore.I’m having this issue with go1.16.4 and newly go1.16.5.
go getorgo mod tidydidn’t fix my issues butgo env -w GOFLAGS=-mod=modactually didFor folks trying out the
go env -w GOFLAGS=-mod=modworkaround, just want to make sure you understand what this does. This command writesGOFLAGS=-mod=modto Go’s configuration file (go env GOENVprints that file’s location). The go command will act as if the-mod=modflag was passed on the command line, unless theGOFLAGSenvironment variable was set.-mod=modtells the go command to updatego.modandgo.sumif anything is missing or inconsistent. This meansgo listand other module-aware commands may have surprising side effects.Also note that this will disable automatic use of
vendordirectories. You’ll need to pass-mod=vendoron the command line to use them again.You can disable this workaround with
go env -u GOFLAGS.This should be fixed in Go 1.17. We don’t plan to backport the fix to 1.16.x; in order to avoid unintended regressions, we normally only backport fixes for security vulnerabilities and severe issues with no workaround.
I was able to resolve my project’s issue with
go mod tidy.It sounds like not everyone is able to resolve it like this, but I wanted to give an update.
Unfortunately I’m also hitting this error and neither
go get -t .norgo get ...that go1.16 suggests to do change anything and as the result: with go1.16 build fails and cannot be fixed at all, while with go1.15 build succeds ok. In other words it is go1.16 regression that cannot be workerd around.I’m also finding that this seems to be unresolvable. Have got two examples of it here:
Tried
go get ./...,go get -t ./..., running the specific items it suggests, runninggo mod tidy- none result in it changing any files to causego mod downloadto start working again.The only thing which seems to work is setting
-mod=modon the build - so I’m pretty sure this is a bug in some form or another@davecheney, thanks for the self-contained repro. I note that
go1.15.8 mod tidyin that repro produces diffs, so the fact that the build fails due to an incompletego.sumis not unexpected given #40728. You should be able to fix that case by runninggo mod tidy(with either Go 1.15.8 or Go 1.16), or by setting-mod=modexplicitly (perhaps asGOFLAGS=-mod=mod).Hey @jayconrod It still happens on go@1.17 (the
-mod=modworkaround is also still working)Seeing the same issue since 1.16 and
go build -mod=modseems to be the only way to fix it:@dmitshur This is next on my list. I expect it will be done early next week.
Hey, guys, I’m using Go 1.16.2 linux/amd64, and I still met this issue, as a result, build with
-mod=modcan solve my problem.-modflag controls whethergo.modmay be automatically updated and whether the vendor directory is used.-mod=modtells the go command to ignore the vendor directory and to automatically updatego.mod, for example, when an imported package is not provided by any known module.-mod=readonlytells the go command to ignore the vendor directory and to report an error ifgo.modneeds to be updated.-mod=vendortells the go command to use the vendor directory. In this mode, the go command will not use the network or the module cache.go.modis 1.14 or higher and a vendor directory is present, the go command acts as if-mod=vendorwere used. Otherwise, the go command acts as if-mod=readonlywere used.see: https://golang.org/ref/mod#build-commands
Seems to be a dependabot issue for not updating
go.sumfiles?This worked for me! Thank you! Also, @jayconrod reply was very useful!
Just added go1.16 to our build/CI matrix, and started seeing this immediately.
Build is successful in go1.15 and go1.14.
https://github.com/firebase/firebase-admin-go/pull/438/checks?check_run_id=2587675888
I’m fairly sure that’s a separate problem, as the exact same error arises in CI if I run
go mod tidylocally and push after dependabot has opened its PR, but don’t have a great public example of that at the moment. Will provide a better example if I get another laterAwesome mate, worked for me
go1.16 test & lint output error message:
solution
go test
golangci-lint
links: https://golang.org/ref/mod#build-commands https://blog.golang.org/go116-module-changes
@bcmills, thanks for feedback. I’m using Go built from source and it is just a regular build from
go1.16-12-g2b7243a62fbootstrapped fromgo1.4.3-16-g4d5426a570. I’ve rechecked it once again in a clean environment and the problem disappears. However I’ve tracked it down to be a problem related to state of~/go/pkg/mod- probably a stale cache problem. Please see details in https://github.com/golang/go/issues/44749.@jayconrod Sure thing. I’ll have a go at getting a repro set up and create a new issue. Thanks.
@billinghamj, thanks! Looking at the specific error message, and at the contents of https://github.com/cuvva/cuvva-public-go/commit/b78beb17ad162d59cdf31d23e37903424513f4f4, I think @seankhliao has it right:
dependabotis adding a checksum for the updated dependency’sgo.modfile, but for some reason not also adding the checksum for the source code.That particular failure mode looks pretty much exactly like #41103 (CL 251880).
So I’m going to guess that your
dependabotis using a Go 1.15 build of thegocommand and also not re-runninggo mod tidyafter updating the dependencies.@bcmills Sure 😃 not a huge issue for us any more as we’ve used the
-mod=modworkaround, but it’s definitely not behaving the same way on 1.16 on my local machine (darwin/arm64 versus linux/amd64 on the build server, not that it should make any diff)This is the failing build: https://github.com/cuvva/cuvva-public-go/runs/2011625714#step:4:62
And the tree at the time: https://github.com/cuvva/cuvva-public-go/tree/b78beb17ad162d59cdf31d23e37903424513f4f4
Also in my case, on my local machine, installed using the off-the-shelf brew bottle, not from source etc
@navytux, using your repro steps and a
<strike> I also see an error from the suggested `go get` command for `…/neonet@…`; that error occurs at build time (it looks like a bug in the package with `GOOS=linux` and `GOARCH=amd64`), but the error can be suppressed by adding the `-d` flag.go1.16obtained usinggo install golang.org/dl/go1.16, I do see a change ingo.sumfromgo get …/lonet@….I think the latter is probably a bug, but… </strike>
[Edit: it does not appear to be a bug. I accidentally ran one command using a
gotipbuild instead, and the package is broken with a Go built from tip.]It’s not at all clear to me why you aren’t seeing any changes at all from the suggested
go get …/lonet@…command. Are you using agocommand installed from the official builds (https://golang.org/dl), or something carrying patches from a third-party distribution?