buildGoModule with local src: inconsistent vendoring

Based on the post Use buildGoModule with local src I put together the following expression:

  thePkg = buildGoModule {
    pname = "mypkg";
    version = "0.0.1";
    src = lib.cleanSource ./.;
    vendorSha256 = sha256:0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5;
  };

That worked when I first started out. Then I had no required packages in go.mod, no go.sum, no internal package, just a cmd/my-tool/main.go, … yes, it was pretty much a “Hello, World!” package.

Then I added code, a couple of internal packages (in internal/...) and some dependencies to go.mod, which of course resulted in a go.sum file. By now the expression above have stopped working, and I get the following output when I try to build:

nix-build --attr pkg
these derivations will be built:
  /nix/store/blhlxnn2fvahpvn4ascyi2wcxznj8iiv-mypkg-0.0.1.drv
building '/nix/store/blhlxnn2fvahpvn4ascyi2wcxznj8iiv-mypkg-0.0.1.drv'...
unpacking sources
unpacking source archive /nix/store/24bshfm5i0wpixrr9avigispybwvzr9f-source
source root is source
patching sources
configuring
building
Building subPackage ./cmd/my-tool
go: inconsistent vendoring in /build/source:
        github.com/beevik/etree@v1.1.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/golang-migrate/migrate/v4@v4.12.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/rs/zerolog@v1.19.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/google/uuid@v1.1.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/lib/pq@v1.8.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt

run 'go mod vendor' to sync, or use -mod=mod or -mod=readonly to ignore the vendor directory
builder for '/nix/store/blhlxnn2fvahpvn4ascyi2wcxznj8iiv-mypkg-0.0.1.drv' failed with exit code 1

I’m not really sure what I can do about it. Running go mod vendor manually doesn’t help (I didn’t really expect it to either).

Any help would be much appreciated.

It looks like this is how a bad vendorSha256 manifests itself. Changing it to lib.fakeSha256, trying a build, copy-pasting the sha256 reported, and finally trying the build again made it all work.

It would have been nice if the wrong sha would have triggered the same error as lib.fakeSha256 does :thinking:

6 Likes

Yeah, this needs to be changed.