cmd/go: -mod=readonly causes go install p@version to fail with "missing go.sum entry"

[eliasnaur]

From https://groups.google.com/g/golang-nuts/c/XeQhJghJGPs

I have GOFLAGS=-mod=readonly in my environment to avoid unnoticed changes to go.mod and go.sum. However, I'm getting a weird error from the (new in 1.16) go install p@version form to install a Go program:

$ cd $(mktemp -d)
$ GOFLAGS=-mod=readonly go install gioui.org/cmd/gogio@40c082e94961adaf55886b45710a54d0247ff1bf
go install gioui.org/cmd/gogio@40c082e94961adaf55886b45710a54d0247ff1bf: gioui.org/c...@v0.0.0-20201218091821-40c082e94961: missing go.sum entry

Clearing GOFLAGS does work:

$ GOFLAGS= go install gioui.org/cmd/gogio@40c082e94961adaf55886b45710a54d0247ff1bf
go: downloading gioui.org v0.0.0-20201218091821-40c082e94961
go: downloading gioui.org/cmd v0.0.0-20201218091821-40c082e94961

I can't explain the difference, nor the error. In case it makes a difference, I have a checkout of gioui.org/cmd/gogio at the above revision where go mod tidy is a no-op.

What version of Go are you using (go version)?

$ go version
go version devel +2de7866470 Fri Dec 18 18:25:14 2020 +0000 darwin/amd64

Does this issue reproduce with the latest release?

Yes

[seankhliao]

go mod tidy removes 2 lines from go.sum at that checkout I looked at the repo root and not the nested module in cmd/

[jayconrod]

Reproduced in 1.16beta1. Thanks for reporting!

[gopherbot]

Change https://golang.org/cl/279490 mentions this issue: cmd/go: set cfg.BuildMod to "readonly" by default with no module root