cmd/go: 'go mod tidy' should retain go.sum entries for the module graph with and without replacements

[bcmills]

Today, go mod tidy trims go.mod and go.sum to just what is needed when building the main module as viewed from inside that module.

However, in many cases users of the module will build from outside that module (especially given #24250). Builds from outside may need additional modules to satisfy the imports as seen from outside, and may need to check sums for those additional modules as well (see #28802).

go mod tidy should ensure that both views of the module are complete and reproducible. That is, it should include enough requirements to satisfy the transitive import graph in both views (and regardless of build tags).

(A flag to compute only the outside view, as in #24666, would not suffice: go mod tidy using only an outside view could lead to missing requirements for builds from inside the module.)

[jtlisi]

@bcmills Is there a recommended workaround when encountering this issue? Is the best recourse to abuse the replace directive even further?

[bcmills]

@jtlisi, this issue is probably less relevant now that #28802 is withdrawn: the go.sum file for the main module is only used when inside that module, so it probably suffices for it to only contain the checksum entries for the internal view of that module.

[bcmills]

Thinking about this some more: users outside the module will not use its go.sum file at all, and users inside the module will always apply its replace directives. So the only go.sum lines we need to retain at the moment are the replacements themselves.

That may change if the set of replacements can vary without changing the go.mod file contents (such as if we adopt #26640 or similar), but for now I think go mod tidy only needs to retain sums for the main module's view of its own dependencies, with replacements already applied.