go build result is different when using dep and go mod

[hoyho]

First, I use dep ensure and then build the project
here I get the build result and sum it's md5:

❯ md5 bin/csi-provisioner
MD5 (bin/csi-provisioner) = 3a3d6d85e792aed799cfe271573df198

Then, try to remove folder vendor and enable go mod by running :

❯ rm  -rf vendor
❯ export GO111MODULE=on
❯ make
mkdir -p bin
CGO_ENABLED=0 GOOS=linux go build -a -ldflags '-X main.version=v1.1.0-7-g218d7eb19-dirty -extldflags "-static"' -o ./bin/csi-provisioner ./cmd/csi-provisioner
go: creating new go.mod: module github.com/kubernetes-csi/external-provisioner
go: copying requirements from Gopkg.lock

now to sum the md5 of build output again:

❯ md5 bin/csi-provisioner
MD5 (bin/csi-provisioner) = a03b732eac78ee2d3076bfd88be727a4

It is different with previous one

How to make sure build result is identical after migrate dep to go mod?

What version of dep are you using (dep version)?

v0.5.0

What dep command did you run?

dep ensure

What did you expect to see?

build output should be identical no matter use dep or gomod

What did you see instead?

build output is different after migrate from dep to go module

[mvdan]

Go's builds are not reproducible by default. In fact, the missing piece was only added to the upcoming 1.13 a couple of weeks ago: #16860

So I'm not sure why you'd expect the binaries to be exactly the same before and after, given that modules and dep store dependency source files in different locations on disk.

[hoyho]

oh really? I know the dependency source files are in different locations on disk and thought they are the same version(same files in different location) therefore I expect the binaries to have the same hash value.

[bcmills]

A build with “same files in different location” does not produce the same resulting binary, because (by default) the debug information for the binary embeds the absolute paths to the source files: simply moving the file changes the resulting binary.

That makes debugging easier, especially in an IDE, but comes at the cost of reproducibility.

Using a go toolchain built from head, you can either use go build -trimpath explicitly, or set GOFLAGS=-trimpath to get reproducible builds by default.