This issue aims to track https://groups.google.com/g/golang-dev/c/wkIlHZL-NNk/m/xy2fFHs6BwAJ. We all seemed to agree that this blog post would be a good idea, but tracking who will do that and when it will happen is hard if all we have is an old email thread that's easy to forget.
I am more than happy to volunteer my help in this, or to even write the first draft. I don't think I've authored anything on the Go blog before. That said, I'm not a technical writer, and there are others who know the details of how go.mod and go.sum work better than I do. So I'm also happy to stand aside or simply provide reviews.
cc @jayconrod @stevetraut
Comment From: mvdan
In that email thread, Jay mentions whether this should be a maintained doc page as opposed to a mostly-frozen blog post. I replied to that point by mentioning that a blog post gets much wider attention as "new content" that can be digested in fifteen minutes. As opposed to a section within a large body of documentation that would likely take a full day's worth of attention to slowly go through.
Comment From: mvdan
Just to reiterate, I'm happy to write a draft for this post, or co-author it with someone else. I won't start unless I get the green light though, because ultimately I cannot upload content to the blog myself.
Comment From: ArnaudBrousseau
@mvdan thanks for opening this issue, I'm glad I found it. As someone who, until recently, bought into the "go.sum is a lock file" myth, I'd be happy to see an official blog post dispelling it. The section of the Go docs explaining why multiple versions of the same package can be present in go.sum (even if a single version is used) is deeply buried under the MVS section. The "aha!" moment for me came from reading the following:
The build list may be inspected with the command go list -m all. Unlike other dependency management systems, the build list is not saved in a “lock” file. MVS is deterministic, and the build list doesn’t change when new versions of dependencies are released, so MVS is used to compute it at the beginning of every module-aware command
Comment From: ansaba
@mvdan , sometime has past since you created the issue and there are couple of blog post about go.mod and go.sum now. I think the right thing to do is to update Documentation on go.doc. WDYT ?
Comment From: mvdan
What documentation do you mean? In any case I'm easy - at this point I no longer have interest in writing a blog post. That was over three years ago :)