cmd/go: prune go.mod and go.sum files from vendored dependencies

Fixes #42970

Change-Id: I79246ef7fc16ae05c8e7b40ffb239a61f6415447
Reviewed-on: https://go-review.googlesource.com/c/go/+/315410
Trust: Bryan C. Mills <[email protected]>
Run-TryBot: Bryan C. Mills <[email protected]>
TryBot-Result: Go Bot <[email protected]>
Reviewed-by: Michael Matloob <[email protected]>

Author: Bryan C. Mills

doc/go1.17.html

@@ -120,7 +120,7 @@ <h4 id="missing-go-directive"><code>go.mod</code> files missing <code>go</code>
   files.)
 </p>
 
-<h4 id="vendor-go-versions"><code>go</code> versions in <code>vendor/modules.txt</code></h4>
+<h4 id="vendor"><code>vendor</code> contents</h4>
 
 <p><!-- golang.org/issue/36876 -->
   If the main module specifies <code>go</code> <code>1.17</code> or higher,
@@ -130,6 +130,14 @@ <h4 id="vendor-go-versions"><code>go</code> versions in <code>vendor/modules.txt
   version is used when building the module's packages from vendored source code.
 </p>
 
+<p><!-- golang.org/issue/42970 -->
+  If the main module specifies <code>go</code> <code>1.17</code> or higher,
+  <code>go</code> <code>mod</code> <code>vendor</code> now omits <code>go.mod</code>
+  and <code>go.sum</code> files for vendored dependencies, which can otherwise
+  interfere with the ability of the <code>go</code> command to identify the correct
+  module root when invoked within the <code>vendor</code> tree.
+</p>
+
 <h2 id="runtime">Runtime</h2>
 
 <p>

src/cmd/go/internal/modcmd/vendor.go

@@ -340,6 +340,15 @@ func matchPotentialSourceFile(dir string, info fs.DirEntry) bool {
 	if strings.HasSuffix(info.Name(), "_test.go") {
 		return false
 	}
+	if info.Name() == "go.mod" || info.Name() == "go.sum" {
+		if gv := modload.ModFile().Go; gv != nil && semver.Compare("v"+gv.Version, "v1.17") >= 0 {
+			// As of Go 1.17, we strip go.mod and go.sum files from dependency modules.
+			// Otherwise, 'go' commands invoked within the vendor subtree may misidentify
+			// an arbitrary directory within the vendor tree as a module root.
+			// (See https://golang.org/issue/42970.)
+			return false
+		}
+	}
 	if strings.HasSuffix(info.Name(), ".go") {
 		f, err := fsys.Open(filepath.Join(dir, info.Name()))
 		if err != nil {

src/cmd/go/testdata/script/mod_vendor_gomod.txt

@@ -0,0 +1,38 @@
+# https://golang.org/issue/42970: As of Go 1.17, go.mod and go.sum files should
+# be stripped from vendored dependencies.
+
+go mod vendor
+cd vendor/example.net/x
+go list all
+! stdout '^example.net/m'
+stdout '^example.net/x$'
+exists ./go.sum
+
+cd ../../..
+go mod edit -go=1.17
+go mod vendor
+cd vendor/example.net/x
+go list all
+stdout '^example.net/m$'
+stdout '^example.net/x$'
+! exists ./go.sum
+
+-- go.mod --
+module example.net/m
+
+go 1.16
+
+require example.net/x v0.1.0
+
+replace example.net/x v0.1.0 => ./x
+-- m.go --
+package m
+
+import _ "example.net/x"
+-- x/go.mod --
+module example.net/x
+
+go 1.16
+-- x/go.sum --
+-- x/x.go --
+package x