Go: cmd/go: allow verifying vendored code

[krancour]

go mod verify is extremely useful for validating the integrity of modules in the local cache.

It would be great if projects that choose to vendor their modules (then presumably building with go build -mod vendor ...) had a similar command to verify the integrity of modules in that directory.

This would satisfy a major requirement that many projects need to account for in their CI process-- ensuring that vendored code hasn't been tampered with.

[bcmills]

This is still on our radar, but probably not happening for 1.13. (We have a lot to do this cycle!)

I'm hoping to get to it in 1.14, but we don't have a 1.14 milestone defined yet.

[sgreene570]

I'm hoping to get to it in 1.14, but we don't have a 1.14 milestone defined yet.

@bcmills is there an update on this? Switching from dep to go mod means losing the ability to verify vendored dependencies before performing builds, etc, which is a big concern.

[bcmills]

@sgreene570, note that in the interim you can simply re-run go mod vendor and check for diffs.

Verifying the checksums of the vendored modules requires the full module content (because that is what is checksummed), so either way you're going to have to download the full module into the local module cache.

[bcmills]

This functionality would also be useful for #36852.

[bcmills]

@jayconrod, @matloob: I think we should aim to get this implemented for 1.15.

[ianlancetaylor]

Do you still hope to get this into 1.15?

[bcmills]

No, it's definitely not happening for 1.15.