cmd/go: in Go 1.17+ modules, add indirect go.mod dependencies separat…

…ely from direct ones

Fixes #45965

Change-Id: If5c0d7b29e9f81be0763f3fa68051d4ef5419990
Reviewed-on: https://go-review.googlesource.com/c/go/+/325922
Trust: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

doc/go1.17.html

@@ -137,6 +137,14 @@ <h4 id="lazy-loading">Lazy module loading</h4>
   <!-- TODO(bcmills): replace the design-doc link with proper documentation. -->
 </p>
 
+<p><!-- golang.org/issue/45965 -->
+  Because the number of additional explicit requirements in the go.mod file may
+  be substantial, in a Go 1.17 module the newly-added requirements
+  on <em>indirect</em> dependencies are maintained in a
+  separate <code>require</code> block from the block containing direct
+  dependencies.
+</p>
+
 <p><!-- golang.org/issue/45094 -->
   To facilitate the upgrade to lazy loading, the
   <code>go</code> <code>mod</code> <code>tidy</code> subcommand now supports

src/cmd/go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639 // indirect
 	golang.org/x/arch v0.0.0-20210502124803-cbf565b21d1e
 	golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e // indirect
-	golang.org/x/mod v0.4.3-0.20210512182355-6088ed88cecd
+	golang.org/x/mod v0.4.3-0.20210608190319-0f08993efd8a
 	golang.org/x/sys v0.0.0-20210511113859-b0526f3d8744 // indirect
 	golang.org/x/term v0.0.0-20210503060354-a79de5458b56
 	golang.org/x/tools v0.1.2-0.20210519160823-49064d2332f9

src/cmd/go.sum

@@ -13,8 +13,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e h1:8foAy0aoO5GkqCvAEJ4VC4P3zksTg4X4aJCDpZzmgQI=
 golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.3-0.20210512182355-6088ed88cecd h1:CuRnpyMrCCBulv0d/y0CswR4K0vGydgE3DZ2wYPIOo8=
-golang.org/x/mod v0.4.3-0.20210512182355-6088ed88cecd/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.4.3-0.20210608190319-0f08993efd8a h1:e8qnjKz4EE6OjRki9wTadWSIogINvq10sMcuBRORxMY=
+golang.org/x/mod v0.4.3-0.20210608190319-0f08993efd8a/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

src/cmd/go/internal/modload/init.go

@@ -999,10 +999,14 @@ func commitRequirements(ctx context.Context, goVersion string, rs *Requirements)
 			Indirect: !rs.direct[m.Path],
 		})
 	}
-	modFile.SetRequire(list)
 	if goVersion != "" {
 		modFile.AddGoStmt(goVersion)
 	}
+	if semver.Compare("v"+modFileGoVersion(), separateIndirectVersionV) < 0 {
+		modFile.SetRequire(list)
+	} else {
+		modFile.SetRequireSeparateIndirect(list)
+	}
 	modFile.Cleanup()
 
 	dirty := index.modFileIsDirty(modFile)

src/cmd/go/internal/modload/modfile.go

@@ -35,6 +35,11 @@ const (
 	// module's go.mod file is expected to list explicit requirements on every
 	// module that provides any package transitively imported by that module.
 	lazyLoadingVersionV = "v1.17"
+
+	// separateIndirectVersionV is the Go version (plus leading "v") at which
+	// "// indirect" dependencies are added in a block separate from the direct
+	// ones. See https://golang.org/issue/45965.
+	separateIndirectVersionV = "v1.17"
 )
 
 const (

src/cmd/go/testdata/script/mod_go_version_missing.txt

@@ -73,10 +73,9 @@ module example.com/m
 
 go $goversion
 
-require (
-	example.com/dep v0.1.0
-	example.com/testdep v0.1.0 // indirect
-)
+require example.com/dep v0.1.0
+
+require example.com/testdep v0.1.0 // indirect
 
 replace (
 	example.com/dep v0.1.0 => ./dep

src/cmd/go/testdata/script/mod_lazy_import_allmod.txt

@@ -139,9 +139,10 @@ go 1.17
 require (
 	a v0.1.0
 	b v0.1.0
-	c v0.1.0 // indirect
 )
 
+require c v0.1.0 // indirect
+
 replace (
 	a v0.1.0 => ./a1
 	b v0.1.0 => ./b1

src/cmd/go/testdata/script/mod_lazy_new_import.txt

@@ -78,10 +78,9 @@ module example.com/lazy
 
 go 1.17
 
-require (
-	example.com/a v0.1.0
-	example.com/b v0.1.0 // indirect
-)
+require example.com/a v0.1.0
+
+require example.com/b v0.1.0 // indirect
 
 replace (
 	example.com/a v0.1.0 => ./a
@@ -94,8 +93,9 @@ module example.com/lazy
 
 go 1.17
 
+require example.com/a v0.1.0
+
 require (
-	example.com/a v0.1.0
 	example.com/b v0.1.0 // indirect
 	example.com/c v0.1.0 // indirect
 )

src/cmd/go/testdata/script/mod_lazy_test_of_test_dep.txt

@@ -148,10 +148,9 @@ module example.com/lazy
 
 go 1.17
 
-require (
-	example.com/a v0.1.0
-	example.com/b v0.1.0 // indirect
-)
+require example.com/a v0.1.0
+
+require example.com/b v0.1.0 // indirect
 
 replace (
 	example.com/a v0.1.0 => ./a

src/cmd/go/testdata/script/mod_retention.txt

@@ -140,8 +140,9 @@ module m
 go $goversion
 
 require (
-	golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect
 	rsc.io/quote v1.5.2
 	rsc.io/sampler v1.3.0 // indirect
 	rsc.io/testonly v1.0.0 // indirect
 )
+
+require golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect

src/cmd/go/testdata/script/mod_tidy_convergence.txt

@@ -90,7 +90,6 @@ cmp go.mod go.mod.postget
 cp go.mod.orig go.mod
 go mod edit -go=1.17 go.mod
 go mod edit -go=1.17 go.mod.tidye
-go mod edit -go=1.17 go.mod.postget
 
 go mod tidy -e
 cmp go.mod go.mod.tidye
@@ -99,7 +98,7 @@ stderr '^example\.net/m imports\n\texample\.net/x: package example\.net/x provid
 
 go get -d example.net/x@v0.1.0 example.net/y@v0.1.0
 go mod tidy
-cmp go.mod go.mod.postget
+cmp go.mod go.mod.postget-117
 
 
 -- go.mod --
@@ -144,6 +143,21 @@ require (
 	example.net/x v0.1.0
 	example.net/y v0.1.0 // indirect
 )
+-- go.mod.postget-117 --
+module example.net/m
+
+go 1.17
+
+replace (
+	example.net/x v0.1.0 => ./x1
+	example.net/x v0.2.0-pre => ./x2-pre
+	example.net/y v0.1.0 => ./y1
+	example.net/y v0.2.0 => ./y2
+)
+
+require example.net/x v0.1.0
+
+require example.net/y v0.1.0 // indirect
 -- m.go --
 package m
 

src/cmd/go/testdata/script/mod_tidy_version.txt

@@ -92,8 +92,9 @@ cmpenv go.mod go.mod.latest
 -- go.mod --
 module example.com/m
 
+require example.net/a v0.1.0
+
 require (
-	example.net/a v0.1.0
 	example.net/c v0.1.0 // indirect
 	example.net/d v0.1.0 // indirect
 )
@@ -118,8 +119,9 @@ module example.com/m
 
 go 1.15
 
+require example.net/a v0.1.0
+
 require (
-	example.net/a v0.1.0
 	example.net/c v0.1.0 // indirect
 	example.net/d v0.1.0 // indirect
 )
@@ -139,8 +141,9 @@ module example.com/m
 
 go 1.15
 
+require example.net/a v0.1.0
+
 require (
-	example.net/a v0.1.0
 	example.net/c v0.1.0 // indirect
 	example.net/d v0.2.0 // indirect
 )
@@ -160,10 +163,9 @@ module example.com/m
 
 go 1.16
 
-require (
-	example.net/a v0.1.0
-	example.net/c v0.1.0 // indirect
-)
+require example.net/a v0.1.0
+
+require example.net/c v0.1.0 // indirect
 
 replace (
 	example.net/a v0.1.0 => ./a
@@ -180,8 +182,9 @@ module example.com/m
 
 go 1.17
 
+require example.net/a v0.1.0
+
 require (
-	example.net/a v0.1.0
 	example.net/b v0.1.0 // indirect
 	example.net/c v0.1.0 // indirect
 )
@@ -201,8 +204,9 @@ module example.com/m
 
 go $goversion
 
+require example.net/a v0.1.0
+
 require (
-	example.net/a v0.1.0
 	example.net/b v0.1.0 // indirect
 	example.net/c v0.1.0 // indirect
 )