cmd/go: go mod tidy can break things

[rogpeppe]

go version devel +d410642f49 Mon Jul 1 21:30:23 2019 +0000 linux/amd64

go env Output

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/rog/.cache/go-build"
GOENV="/home/rog/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY="github.com/heetch"
GONOSUMDB="github.com/heetch"
GOOS="linux"
GOPATH="/home/rog/src/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/home/rog/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/rog/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/rog/src/go/src/github.com/heetch/universe/src/services/driver-state/state/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build613282230=/tmp/go-build -gno-record-gcc-switches"

I ran the following commands. After go mod init, the build succeeds, but after running go mod tidy, the build fails and the consul dependency requirement is no longer respected.

% go mod init
go: creating new go.mod: module 
go: copying requirements from glide.lock
% go install ./...
% go list -m all | grep consul
github.com/hashicorp/consul v1.5.1
github.com/hashicorp/consul/api v1.1.0
github.com/hashicorp/consul/sdk v0.1.1
% go mod tidy
% go list -m all | grep consul
github.com/hashicorp/consul v1.0.7
github.com/hashicorp/consul/api v1.1.0
github.com/hashicorp/consul/sdk v0.1.1
% go install ./...
build private-module/cmd/private-cmd: cannot load github.com/hashicorp/consul/api: ambiguous import: found github.com/hashicorp/consul/api in multiple modules:
	github.com/hashicorp/consul v1.0.7 (/home/rog/src/go/pkg/mod/github.com/hashicorp/consul@v1.0.7/api)
	github.com/hashicorp/consul/api v1.1.0 (/home/rog/src/go/pkg/mod/github.com/hashicorp/consul/api@v1.1.0)

[rogpeppe]

I have a somewhat minimal reproducer of this which I can send privately.

[bcmills]

I'm curious: does go mod download produce the same sort of transition? (My guess is that it does, because I think I know where this bug comes from...)

[bcmills]

Oh, wait. go mod tidy downgrades consul, presumably because it doesn't provide any packages in the transitive import graph. That makes this a duplicate of #27899, albeit with an interesting mechanism leading to the ambiguous import.

[bcmills]

In the meantime, this could have been avoided within the github.com/hashicorp/consul/api module, by adding a require on some newer version of github.com/hashicorp/consul as described in https://golang.org/issue/27858#issuecomment-425089484.

[bcmills]

Duplicate of #27899