cmd/go: "mod tidy" on tip can tidy less than 1.17

[mvdan]

I had a bizarre situation at work where, developing with Go master locally, CI would tell me my module was tidy.

Took me a minute to realise that Go master was doing less tidying than Go 1.17. Repro below:

$ git clone https://github.com/mvdan/indexer-reference-provider repro
$ cd repro
$ git checkout -q 014794212253ab9a6f6892c36a04a18539801b64
$ go version
go version devel go1.18-92655582d0 Mon Nov 15 19:24:28 2021 +0000 linux/amd64
$ go mod tidy
$ git diff
$ wgo1 go version
go version go1.17.3 linux/amd64
$ wgo1 go mod tidy
$ git diff
diff --git a/go.mod b/go.mod
index 9f2b498..ad629c5 100644
--- a/go.mod
+++ b/go.mod
@@ -20,7 +20,6 @@ require (
    github.com/ipfs/go-ipfs-blocksutil v0.0.1
    github.com/ipfs/go-log/v2 v2.3.0
    github.com/ipfs/go-merkledag v0.4.0 // indirect
-   github.com/ipld/go-car v0.3.1 // indirect
    github.com/ipld/go-car/v2 v2.0.3-0.20210920144420-f35d88ce16ca
    github.com/ipld/go-codec-dagpb v1.3.0
    github.com/ipld/go-ipld-prime v0.14.0
diff --git a/go.sum b/go.sum
index 218d56c..476b047 100644
--- a/go.sum
+++ b/go.sum
@@ -524,15 +524,11 @@ github.com/ipfs/go-unixfs v0.2.6/go.mod h1:GTTzQvaZsTZARdNkkdjDKFFnBhmO3e5mIM1Pk
 github.com/ipfs/go-verifcid v0.0.1 h1:m2HI7zIuR5TFyQ1b79Da5N9dnnCP1vcu2QqawmWlK2E=
 github.com/ipfs/go-verifcid v0.0.1/go.mod h1:5Hrva5KBeIog4A+UpqlaIU+DEstipcJYQQZc0g37pY0=
 github.com/ipld/go-car v0.1.0/go.mod h1:RCWzaUh2i4mOEkB3W45Vc+9jnS/M6Qay5ooytiBHl3g=
-github.com/ipld/go-car v0.3.1 h1:WT+3cdmXlvmWOlGxk9webhj4auGO5QvgqC2vCCkFRXs=
-github.com/ipld/go-car v0.3.1/go.mod h1:dPkEWeAK8KaVvH5TahaCs6Mncpd4lDMpkbs0/SPzuVs=
 github.com/ipld/go-car/v2 v2.0.3-0.20210920144420-f35d88ce16ca h1:EJYuFXYChrlSYtnjd/EybBkRQI7AJXhXB2Rd8GzSaHc=
 github.com/ipld/go-car/v2 v2.0.3-0.20210920144420-f35d88ce16ca/go.mod h1:Xr6GwkDhv8dtOtgHzOynAkIOg0t0YiPc5DxBPppWqZA=
-github.com/ipld/go-codec-dagpb v1.2.0/go.mod h1:6nBN7X7h8EOsEejZGqC7tej5drsdBAXbMHyBT+Fne5s=
 github.com/ipld/go-codec-dagpb v1.3.0 h1:czTcaoAuNNyIYWs6Qe01DJ+sEX7B+1Z0LcXjSatMGe8=
 github.com/ipld/go-codec-dagpb v1.3.0/go.mod h1:ga4JTU3abYApDC3pZ00BC2RSvC3qfBb9MSJkMLSwnhA=
 github.com/ipld/go-ipld-prime v0.0.2-0.20191108012745-28a82f04c785/go.mod h1:bDDSvVz7vaK12FNvMeRYnpRFkSUPNQOiCYQezMD/P3w=
-github.com/ipld/go-ipld-prime v0.9.0/go.mod h1:KvBLMr4PX1gWptgkzRjVZCrLmSGcZCb/jioOQwCqZN8=
 github.com/ipld/go-ipld-prime v0.9.1-0.20210324083106-dc342a9917db/go.mod h1:KvBLMr4PX1gWptgkzRjVZCrLmSGcZCb/jioOQwCqZN8=
 github.com/ipld/go-ipld-prime v0.11.0/go.mod h1:+WIAkokurHmZ/KwzDOMUuoeJgaRQktHtEaLglS3ZeV8=
 github.com/ipld/go-ipld-prime v0.12.0/go.mod h1:hy8b93WleDMRKumOJnTIrr0MbbFbx9GD6Kzxa53Xppc=

This sounds like a bug to me - I would imagine that Go 1.17 and the upcoming 1.18 would agree on what a tidied module is, especially given how this go.mod says go 1.16.

cc @bcmills @matloob

[bcmills]

This is likely an intentional consequence of CL 344572 (#47738), but we should probably have a release note for that.

(We may also need to update go mod why to report these, but that's arguably part of #27900.)

[mvdan]

Ah, a release note would certainly be nice.

I guess I should be using go mod tidy with the same version of Go that CI uses to check with. Historically, I've gotten away with tip being basically the same in terms of tidying.

[cherrymui]

Any update on this? The release notes doesn't seem to mention this yet. Thanks. (pinging as this is a release blocker)

[thepudds]

Hi @bcmills, is it possible for some modules that switching back and forth between 'go mod tidy' in 1.17 vs 1.18 would leave go.sum in a state where one go version refuses to build due to a missing go.sum entry that the other go version removed?

(And just to state the obvious, no rush on a reply).

[bcmills]

@thepudds, if one runs go mod tidy with an older version of the go command, it is possible that go build will fail on a newer version. (However, running go mod tidy with the newer version should not break the older version.)

[gopherbot]

Change https://golang.org/cl/378577 mentions this issue: doc/go1.18: add a release note for 'go mod tidy' checksum changes