cmd/go: missing go.sum entry message when running go list ...

[FractalU]

Go version

go version go1.20.14 windows/amd64

Output of go env in your module/workspace:

set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\Richard\AppData\Local\go-build
set GOENV=C:\Users\Richard\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=-ldflags=-w
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\Richard\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\Richard\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.20.14
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=NUL
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=C:\Use
rs\Richard\AppData\Local\Temp\go-build2449578639=/tmp/go-build -gno-record-gcc-switches

What did you do?

With the following go.mod and the main.go files I ran go get. [This creates the following go.sum file.

go.mod

module main

go 1.23

require golang.org/x/net v0.37.0

main.go

package main

import (
	"fmt"
	"golang.org/x/net/dict"
)

func main() {
	fmt.Println("Whatever")
}

go.sum

golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=

What did you see happen?

When I ran go list ... I get the following output.

pattern ...: golang.org/x/crypto@v0.36.0: missing go.sum entry

When I ran go list golang.org/x/crypto/... I get the following output.

pattern golang.org/x/crypto/...: golang.org/x/crypto@v0.36.0: missing go.sum entry

When I ran go list golang.org/x/sys/... I get the following output.

pattern golang.org/x/sys/...: golang.org/x/sys@v0.31.0: missing go.sum entry

When I ran go list golang.org/x/term/... I get the following output.

pattern golang.org/x/term/...: golang.org/x/term@v0.30.0: missing go.sum entry

When I ran go list golang.org/x/text/... I get the following output.

pattern golang.org/x/text/...: golang.org/x/text@v0.23.0: missing go.sum entry

When I ran go list golang.org/x/net/... I get the following output.

golang.org/x/net/bpf
golang.org/x/net/context
golang.org/x/net/context/ctxhttp
golang.org/x/net/dict
golang.org/x/net/dns/dnsmessage
golang.org/x/net/html
golang.org/x/net/html/atom
golang.org/x/net/html/charset
golang.org/x/net/http/httpguts
golang.org/x/net/http/httpproxy
golang.org/x/net/http2
golang.org/x/net/http2/h2c
golang.org/x/net/http2/h2i
golang.org/x/net/http2/hpack
golang.org/x/net/icmp
golang.org/x/net/idna
golang.org/x/net/internal/gate
golang.org/x/net/internal/http3
golang.org/x/net/internal/httpcommon
golang.org/x/net/internal/iana
golang.org/x/net/internal/socket
golang.org/x/net/internal/socks
golang.org/x/net/internal/sockstest
golang.org/x/net/internal/testcert
golang.org/x/net/internal/timeseries
golang.org/x/net/ipv4
golang.org/x/net/ipv6
golang.org/x/net/nettest
golang.org/x/net/netutil
golang.org/x/net/proxy
golang.org/x/net/publicsuffix
golang.org/x/net/quic
golang.org/x/net/trace
golang.org/x/net/webdav
golang.org/x/net/webdav/internal/xml
golang.org/x/net/websocket
golang.org/x/net/xsrftoken

When I ran go list -m all I get the following output.

main
golang.org/x/crypto v0.36.0
golang.org/x/net v0.37.0
golang.org/x/sys v0.31.0
golang.org/x/term v0.30.0
golang.org/x/text v0.23.0

What did you expect to see?

go list ... should just all the packages.

Likewise should the following.

go list golang.org/x/crypto/...
go list golang.org/x/sys/...
go list golang.org/x/term/...
go list golang.org/x/text/...

Currently, only go list golang.org/x/net/... lists all the packages and doesn't error out with a missing go.sum entry message. This is because the go.sum has only entries with golang.org/x/net.

My guess is, that the go.sum file generated by go get contains too few entries. It doesn't contain the entries for the dependencies listed when running go list -m all.

[seankhliao]

See also #37227, go.mod/go.sum does not include dependencies that aren't needed when pruned out of the module graph.