Doesn't work about gographs

[siggy]

dataframe-go repo is missing go.sum:

$ go install github.com/loov/[email protected]
$ git clone https://github.com/rocketlaunchr/dataframe-go
$ cd dataframe-go
$ goda graph -short -cluster ./...
go [-e -json -compiled=true -test=false -export=false -deps=true -find=false -- ./...]: exit status 1: go: cloud.google.com/[email protected]: missing go.sum entry; to add it:
	go mod download cloud.google.com/go
go: cloud.google.com/[email protected]: missing go.sum entry; to add it:
	go mod download cloud.google.com/go

[pjebs]

You don't need a go.sum

[siggy]

https://github.com/golang/go/wiki/Modules#should-i-commit-my-gosum-file-as-well-as-my-gomod-file

[pjebs]

https://github.com/golang/go/wiki/Modules#is-gosum-a-lock-file-why-does-gosum-include-information-for-module-versions-i-am-no-longer-using

No, go.sum is not a lock file. The go.mod files in a build provide enough information for 100% reproducible builds

[siggy]

It's true go.sum is not necessary for builds, but that's like saying passwords are not necessary for websites. Yes you can technically set it up that way, but it's extremely ill advised from a security standpoint.

Two things per my first comment:

1. The failure you reported is coming from a mature Go ecosystem tool, goda, which itself gets the error from the golang/go repo, which (correctly) requires a go.sum when calling goModSummary:

   • https://github.com/golang/go/blob/45f45444b307cea7c8330b100b30382e642e010f/src/cmd/go/internal/modload/import.go#L713
   • https://github.com/golang/go/blob/45f45444b307cea7c8330b100b30382e642e010f/src/cmd/go/internal/modload/modfile.go#L589

2. If you just want a dependency graph of that repo, you can simply run the commands I provided in my first comment.

More info: https://go.dev/ref/mod#authenticating