cmd/go: "go mod why" doesn't explain some go.sum entries

[bradfitz]

Our go.sum has an entry that go mod tidy doesn't delete and go mod why doesn't explain.

The tailscale.com module (https://github.com/tailscale/tailscale) at git rev c79c72c4fce75a37061d37b6b18e018e8a70b255:

$ go version
go version go1.18 linux/amd64
$ go mod tidy
$ git diff
$ git grep jwt
go.sum:github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
$ go mod why github.com/dgrijalva/jwt-go
# github.com/dgrijalva/jwt-go
(main module does not need package github.com/dgrijalva/jwt-go)
$ find . -name go.mod
./go.mod

It's likely we're confused about something but it seems like either go mod why or go mod tidy should do something differently? Several of us are confused enough to file a bug.

If this is working as intended, feature request: go mod why --sum-too

[mvdan]

@bradfitz did you mean to use go mod why -m? go mod why works on packages and go.sum lists modules.

[cespare]

@mvdan same result:

$ go mod why -m github.com/dgrijalva/jwt-go
# github.com/dgrijalva/jwt-go
(main module does not need module github.com/dgrijalva/jwt-go)

@bradfitz I believe this is essentially #27900.

From looking at the output of go mod graph it looks like the paths that reach github.com/dgrijalva/jwt-go include various versions of these modules:

github.com/spf13/viper
go.etcd.io/etcd
github.com/google/certificate-transparency-go
github.com/google/trillian
github.com/mozilla/tls-observatory
github.com/securego/gosec/v2

/cc @bcmills

[bcmills]

Duplicate of #27900