cmd/go: implement Go checksum database support

This CL adds support for consulting the Go checksum database
when downloading a module that is not already listed in go.sum.
The overall system is described at golang.org/design/25530-sumdb,
and this CL implements the functionality described specifically in
golang.org/design/25530-sumdb#command-client.

Although the eventual plan is to set GOPROXY and GOSUMDB to
default to a Google-run proxy serving the public Go ecosystem,
this CL leaves them off by default.

Fixes #30601.

Change-Id: Ie46140f93c6cc2d85573fbce0878a258819ff44d
Reviewed-on: https://go-review.googlesource.com/c/go/+/173951
Run-TryBot: Russ Cox <[email protected]>
Reviewed-by: Emmanuel Odeke <[email protected]>
Reviewed-by: Jay Conrod <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>

Author: rsc

src/cmd/go/alldocs.go

@@ -265,12 +265,14 @@ var knownEnv = `
 	GOHOSTOS
 	GOMIPS
 	GOMIPS64
-	GONOVERIFY
+	GONOPROXY
+	GONOSUMDB
 	GOOS
 	GOPATH
 	GOPPC64
 	GOPROXY
 	GOROOT
+	GOSUMDB
 	GOTMPDIR
 	GOTOOLDIR
 	GOWASM
@@ -293,8 +295,45 @@ var (
 	GOMIPS64 = envOr("GOMIPS64", objabi.GOMIPS64)
 	GOPPC64  = envOr("GOPPC64", fmt.Sprintf("%s%d", "power", objabi.GOPPC64))
 	GOWASM   = envOr("GOWASM", fmt.Sprint(objabi.GOWASM))
+
+	GOPROXY   = goproxy()
+	GOSUMDB   = gosumdb()
+	GONOPROXY = Getenv("GONOPROXY")
+	GONOSUMDB = Getenv("GONOSUMDB")
 )
 
+func goproxy() string {
+	v := Getenv("GOPROXY")
+	if v != "" {
+		return v
+	}
+
+	// Proxy is off by default for now.
+	// TODO(rsc): Remove this condition, turning it on always.
+	// (But do NOT do this without approval from rsc.)
+	if true {
+		return "direct"
+	}
+
+	return "https://proxy.golang.org"
+}
+
+func gosumdb() string {
+	v := Getenv("GOSUMDB")
+	if v != "" {
+		return v
+	}
+
+	// Checksum database is off by default except when GOPROXY is proxy.golang.org.
+	// TODO(rsc): Remove this condition, turning it on always.
+	// (But do NOT do this without approval from rsc.)
+	if !strings.HasPrefix(GOPROXY, "https://proxy.golang.org") {
+		return "off"
+	}
+
+	return "sum.golang.org"
+}
+
 // GetArchEnv returns the name and setting of the
 // GOARCH-specific architecture environment variable.
 // If the current architecture has no GOARCH-specific variable,

src/cmd/go/internal/cfg/cfg.go

@@ -8,13 +8,13 @@ package envcmd
 import (
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
-	"unicode/utf8"
-	"io/ioutil"
-	"sort"
 	"runtime"
+	"sort"
 	"strings"
+	"unicode/utf8"
 
 	"cmd/go/internal/base"
 	"cmd/go/internal/cache"
@@ -56,7 +56,7 @@ func init() {
 
 var (
 	envJson = CmdEnv.Flag.Bool("json", false, "")
-	envU = CmdEnv.Flag.Bool("u", false, "")
+	envU    = CmdEnv.Flag.Bool("u", false, "")
 	envW    = CmdEnv.Flag.Bool("w", false, "")
 )
 
@@ -74,10 +74,13 @@ func MkEnv() []cfg.EnvVar {
 		{Name: "GOFLAGS", Value: cfg.Getenv("GOFLAGS")},
 		{Name: "GOHOSTARCH", Value: runtime.GOARCH},
 		{Name: "GOHOSTOS", Value: runtime.GOOS},
+		{Name: "GONOPROXY", Value: cfg.GONOPROXY},
+		{Name: "GONOSUMDB", Value: cfg.GONOSUMDB},
 		{Name: "GOOS", Value: cfg.Goos},
 		{Name: "GOPATH", Value: cfg.BuildContext.GOPATH},
-		{Name: "GOPROXY", Value: cfg.Getenv("GOPROXY")},
+		{Name: "GOPROXY", Value: cfg.GOPROXY},
 		{Name: "GOROOT", Value: cfg.GOROOT},
+		{Name: "GOSUMDB", Value: cfg.GOSUMDB},
 		{Name: "GOTMPDIR", Value: cfg.Getenv("GOTMPDIR")},
 		{Name: "GOTOOLDIR", Value: base.ToolDir},
 	}
@@ -387,7 +390,7 @@ func updateEnvFile(add map[string]string, del map[string]bool) {
 		}
 	}
 	for key, val := range add {
-		lines = append(lines, key + "=" + val + "\n")
+		lines = append(lines, key+"="+val+"\n")
 	}
 
 	// Delete requested variables (go env -u).
@@ -404,7 +407,7 @@ func updateEnvFile(add map[string]string, del map[string]bool) {
 	for i := 0; i <= len(lines); i++ {
 		if i == len(lines) || lineToKey(lines[i]) == "" {
 			sortKeyValues(lines[start:i])
-			start = i+1
+			start = i + 1
 		}
 	}
 

src/cmd/go/internal/envcmd/env.go

@@ -0,0 +1,17 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build cmd_go_bootstrap
+
+package modfetch
+
+import "cmd/go/internal/module"
+
+func useSumDB(mod module.Version) bool {
+	return false
+}
+
+func lookupSumDB(mod module.Version) (string, []string, error) {
+	panic("bootstrap")
+}