cmd/go: go mod edit -replace succeeds even when there isn't a module to replace

[james-lawrence]

I believe this is invalid behavior and unexpected.

What version of Go are you using (go version)?

go version
go version go1.14.2 linux/amd64

What did you do?

cat go.mod 
module example

go 1.13
go mod edit -replace github.com/pkg/errors=/tmp/errors
cat go.mod 
module example

go 1.13

replace github.com/pkg/errors => /tmp/errors

What did you expect to see?

an error about replacing a unknown module.

What did you see instead?

a replace statement was added to go.mod.

[dmitshur]

/cc @bcmills @jayconrod @matloob

[jayconrod]

Thanks for reporting, but this looks like it's working as intended.

go mod edit is meant to be a low-level tool for editing go.mod files. It does very little validation of the go.mod beyond checking the syntax. In particular, it doesn't fetch or read go.mod files for dependencies. That fetch would be necessary to check whether a replaced module exists or not, since a replaced module could be indirectly required.

[james-lawrence]

@jabagawee so the answer here is that this that resulting go.mod file is valid. even though its unclear what it even does?

what happens when other go mod commands are executed on the resulting file?

• go mod download: does it fetch?
• go mod tidy: does it get removed properly?
• go mod verify: does it validate the dependency as unnecessary?

I don't really care if go mod edit directly verifies the mod file i suppose. but there should be a command that does. because I'm unsure if this go.mod is valid and i know of at least 1 project that is generating mod files like the above.

[jayconrod]

If a later command needs to fetch any version of github.com/pkg/errors, it will read from /tmp/errors instead of going out to the network. The command doesn't need to fetch that module (including if the module is not required by anything), the replace will be ignored.

go mod tidy doesn't remove replace directives. #30516 is a proposal suggesting that it should. I think that's close to what you're asking for here.

go mod verify doesn't check replacements. It checks that modules downloaded into the cache match go.sum. It's mainly used to detect cache corruption, since modules are also verified when they're downloaded.