cmd/go: go mod vendor changes go.mod

[horgh]

What version of Go are you using (go version)?

$ go version
go version go1.12.7 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/vagrant/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/vagrant/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/vagrant/go/src/github.maxmind.com/maxmind/mm_website.git/go/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build312829003=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ env|grep GO111                                                         
GO111MODULE=on
$ go mod tidy
$ grep modern-go go.mod
$ go mod vendor
$ grep modern-go go.mod
        github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
        github.com/modern-go/reflect2 v1.0.1 // indirect

This started happening after I added a dependency on github.com/lestrrat-go/jwx in my go.mod:

$ grep jwx go.mod
        github.com/lestrrat-go/jwx v0.9.0

The import in my program is github.com/lestrrat-go/jwx/jwk.

Interestingly there is this as well:

$ go mod tidy
$ grep modern-go go.mod
$ cd my-program
my-program$ go build
my-program$ cd ..
$ grep modern-go go.mod
        github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
        github.com/modern-go/reflect2 v1.0.1 // indirect
$ go mod tidy
$ grep modern-go go.mod

Unfortunately this is happening in a big closed source repo. I tried to come up with a small reproducer but I'm not seeing the behaviour changes there.

What did you expect to see?

go.mod not to be changed when running go mod vendor or go build after running go mod tidy

What did you see instead?

go.mod had lines added

More details

I found #31612 which sounds similar but lacks details. And #30857 which sounds similar but was fixed.

[horgh]

Actually I believe the new import I mentioned is not the culprit as we just did some module updates as well. I'll try to find out more.

[horgh]

This seems to be it:

$ grep -e prometheus/client_golang -e modern-go go.mod
        github.com/prometheus/client_golang v1.0.0
$ go get github.com/prometheus/client_golang@v1.1.0
$ grep -e prometheus/client_golang -e modern-go go.mod
        github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
        github.com/modern-go/reflect2 v1.0.1 // indirect
        github.com/prometheus/client_golang v1.1.0
$ go mod tidy
$ grep -e prometheus/client_golang -e modern-go go.mod
        github.com/prometheus/client_golang v1.1.0
$ go mod vendor
$ grep -e prometheus/client_golang -e modern-go go.mod
        github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
        github.com/modern-go/reflect2 v1.0.1 // indirect
        github.com/prometheus/client_golang v1.1.0

[bcmills]

@horgh, this seems likely to be #31248, which is fixed at head but not in go1.13beta1.

Please verify whether the issue still occurs using a go command built from head. (The gotip binary is the easy way to install it.)

[horgh]

Yes, it sounds like the same thing. I just tested and the behaviour is normal in gotip.

Sorry I missed that issue. Thank you for looking at it & the quick response! I'll close this then.

(I didn't know about gotip, that is cool!)