tree 59c5dc1dbc8fd20345888f3b7de3181bc46151e8
parent cd1f2ee17589ba3f7f17471441f18612f864e850
author Russ Cox <rsc@golang.org> 1530131996 -0400
committer Russ Cox <rsc@golang.org> 1530245645 +0000

cmd/go/internal/modfetch: check go.mod content using go.sum

go.sum (formerly go.modverify) already contains lines like

	github.com/pkg/foo v1.2.3 h1:hashhashhashhashhash

where the hash is a checksum over the whole file tree of the module.
After this CL, it will also contain lines like:

	github.com/pkg/foo v1.2.3/go.mod h1:hashhashhashhashhash

(note the /go.mod suffix on the version), where the hash is a checksum
over the one-file tree containing only the go.mod for that module.
This hash is recorded even for auto-generated go.mod files,
because no matter how it arises, the exact go.mod is important
for later reproducibility.

Fixes golang/go#25526.

Change-Id: Ib0ff32f45dd30421907f3ba181db726c7ac9379c
Reviewed-on: https://go-review.googlesource.com/121301
Reviewed-by: Bryan C. Mills <bcmills@google.com>