cmd/go: go mod verify reports "all modules verified" in auto mode

[jsha]

go version go1.12 linux/amd64

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/jsha/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/jsha/gopkg"
GOPROXY=""
GORACE=""
GOROOT="/home/jsha/go1.12"
GOTMPDIR=""
GOTOOLDIR="/home/jsha/go1.12/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build307902328=/tmp/go-build -gno-record-gcc-switches"

What did you do?

• Added a go.mod to my package, converting it to module mode.
• Intentionally modified one of its dependencies (yaml.v2) in the module cache.
• Ran go mod verify.

What did you expect to see?

gopkg.in/yaml.v2 v2.2.2: dir has been modified (/home/jsha/gopkg/pkg/mod/gopkg.in/[email protected])

What did you see instead?

all modules verified

This is with GO111MODULE unset, which I understand should put Go modules in "auto" mode, which should be equivalent to "on" for this command, since go.mod was present.

I get the same results if I run with an explicit GO111MODULE=auto or GO111MODULE=off. If I run with GO111MODULE=on, I see the expected error.

I think regardless of whether go mod verify chooses module mode or not, it should never report "all modules verified" if it didn't do any verification. Similarly it should never return 0 if it didn't do any verification.

[andybons]

@bcmills @jayconrod

[bcmills]

This is the same underlying problem as #31237, I believe.

[bcmills]

Should be fixed by CL 174697. Please let us know if you're still seeing a problem with go 1.13 or later.