---
id: "bug-1607"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "apiserver"
severity: "unknown"
timestamp: "2026-08-20T16:15:00Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/frontend/apiserver/go.sum"]
tags: ["go", "go.sum", "go-modules", "build", "side-effect", "build-time-versioning"]
related: []
legacy: true
---

# bug-1607: `git status` showed src/frontend/apiserver/go.sum modified (+65 lines) after a direct `go build…

## Description
`git status` showed src/frontend/apiserver/go.sum modified (+65 lines) after a direct `go build ./cmd/main.go` invocation that never touched go.mod and produced a successful, working binary -- no warning or error printed by the build itself

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
A plain `go build` (default `-mod` setting, `go env GOFLAGS` confirmed empty) blocks go.mod EDITS under Go 1.16+'s readonly-by-default policy, but does NOT by itself block go.sum EXTENSION for modules already implied by go.mod's requirements -- resolving the full module graph for cgo-enabled apiserver added ~65 unrelated indirect-dependency /go.mod-hash-only lines to the committed go.sum as a silent side effect.

## Fix
Pass `-mod=readonly` explicitly on every direct `go build` invocation against this repo (src/tools/test-version-startup-consistency.sh's apiserver build step). Confirmed live: the identical build still succeeds under explicit -mod=readonly with zero go.sum diff, so nothing was genuinely missing -- the extra entries were pure side effect of the laxer default. Reverted the accidental go.sum change via `git checkout -- src/frontend/apiserver/go.sum` before re-running with the fix.

## Verification
_Not recorded (migrated from buglog.json)._

## References
_Not recorded (migrated from buglog.json)._