cmd/go/internal/modcmd: correctly filter out main modules in verify

This change fixes a bug where we incorrectly filtered out the main
modules from the beginning of the build list before verifying them. We
made the assumption that the first MainModules.Len() entries of the
build list were the main modules, but now it can contain the go and
toolchain version entries, so removing the first MainModules.Len()
entries could leave main module names in the build list if any of
their names sorted after the string 'go'.

Fixes #62663

Change-Id: I35ab6857a556f58d306303322afe24c48fc8b38f
Reviewed-on: https://go-review.googlesource.com/c/go/+/565378
Reviewed-by: Bryan Mills <bcmills@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/src/cmd/go/internal/modcmd/verify.go b/src/cmd/go/internal/modcmd/verify.go
index 4552ed1ba279ab8ec1ce132c3fd25508c2ddbac9..d07f730c5d0dcf90747454817e80b5e879d831af 100644 (file)
--- a/src/cmd/go/internal/modcmd/verify.go
+++ b/src/cmd/go/internal/modcmd/verify.go
@@ -61,7 +61,7 @@ func runVerify(ctx context.Context, cmd *base.Command, args []string) {
        if err != nil {
                base.Fatal(err)
        }
-       mods := mg.BuildList()[modload.MainModules.Len():]
+       mods := mg.BuildList()
        // Use a slice of result channels, so that the output is deterministic.
        errsChans := make([]<-chan []error, len(mods))
 
@@ -94,6 +94,9 @@ func verifyMod(ctx context.Context, mod module.Version) []error {
                // "go" and "toolchain" have no disk footprint; nothing to verify.
                return nil
        }
+       if modload.MainModules.Contains(mod.Path) {
+               return nil
+       }
        var errs []error
        zip, zipErr := modfetch.CachePath(ctx, mod, "zip")
        if zipErr == nil {

diff --git a/src/cmd/go/testdata/script/mod_verify_work.txt b/src/cmd/go/testdata/script/mod_verify_work.txt
new file mode 100644 (file)
index 0000000..d9f5a54
--- /dev/null
+++ b/src/cmd/go/testdata/script/mod_verify_work.txt
@@ -0,0 +1,24 @@
+# Regression test for Issue #62663: we would filter out the toolchain and
+# main modules from the build list incorrectly, leading to the workspace
+# modules being checked for correct sums. Specifically this would happen when
+# the module name sorted after the virtual 'go' version module name because
+# it could not get chopped off when we removed the MainModules.Len() modules
+# at the beginning of the build list and we would remove the go module instead.
+
+go mod verify
+
+-- go.work --
+go 1.21
+
+use (
+    ./a
+    ./b
+)
+-- a/go.mod --
+module hexample.com/a // important for test that module name sorts after 'go'
+
+go 1.21
+-- b/go.mod --
+module hexample.com/b // important for test that module name sorts after 'go'
+
+go 1.21
\ No newline at end of file