proposal: cmd/go: error out of go mod download if the go.mod file is inconsistent

[bcmills]

In Go 1.11, most go subcommands updated the go.mod file implicitly whenever it was found to be inconsistent. Starting in Go 1.16, we changed the default to -mod=readonly, which caused commands other than the go mod subcommands to instead error out if changes are needed to the go.mod or go.sum file.

However, go mod subcommands continued to update go.mod files until #45551 (in Go 1.18), and go mod download is still the command that we use to add checksums to the go.sum file, especially as a workaround for issues like #56222.

#45551 suggested that:

• go mod download always loads the build list and reports an error if go.mod needs to be updated instead of updating it automatically.
• go mod download only adds a hash to go.sum if the corresponding module is explicitly named on the command line (not simply matched by all or a wildcard or implied by a lack of arguments) without an explicit version or at the version in the build list.

Unfortunately, that part of the issue was not implemented, and I don't recall why. (Perhaps @jayconrod or @matloob remembers? I wonder if it was blocked on a decision on #44435.)

Given #44435, I propose that we make a similar change as to what was suggested in #45551, but perhaps a little simpler:

• go mod download should report an error if it needs to load the go.mod file and finds that it needs to be updated.
• go mod download without arguments should report an error of the go.sum file omits any checksum needed to compute the module graph or needed for one of the modules to be downloaded (from the set of modules defined in cmd/go: narrow 'mod download' default set #44435).
• go mod download with explicit arguments should save checksums for each module that matches an argument that does not have an explicit version suffix.

[gopherbot]

Change https://go.dev/cl/540779 mentions this issue: cmd/go: allow toolchain upgrades in 'go mod download' when we would already allow go.mod updates