Repository: go
Issue: cmd/go: document different ways go.sum is populated
Labels: Documentation,NeedsFix

<!-- Please answer these questions before submitting your issue. Thanks! -->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.11.4 darwin/amd64
</pre>

### Does this issue reproduce with the latest release?

1.11.4 is the latest release

### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/lukasz/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/lukasz/Go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/qs/6r1dd8md22bggtghnmmhlf9m0000gn/T/go-build246619765=/tmp/go-build -gno-record-gcc-switches -fno-common"
</pre></details>

### What did you do?

<!--
If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on play.golang.org is best.
-->

This was noticed via https://github.com/renovatebot/renovate/issues/3017, I didn't manage to find any details of what should be in `go.sum`.
`go get -d` populates `go.sum` file with different content if a dependency present in `go.mod` is used or not

#### Dependency used

go.mod:
```
module github.com/prymitive/test

require gopkg.in/yaml.v2 v2.2.2
```

main.go
```
package main

import _ "gopkg.in/yaml.v2"

func main() {}
```

Running `go get` creates a `go.sum` file:
```
$ GO111MODULE=on go get -d
$ cat go.sum
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
```

####

If I remove `import _ "gopkg.in/yaml.v2"` line from `main.go` so that it contains:

```
package main

func main() {}
```

Remove `go.sum` and re-run `go get`:

```
$ rm go.sum
$ GO111MODULE=on go get -d
$ cat go.sum
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
```

I'll get one line less in `go.sum` file (`gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=`).

### What did you expect to see?

I expected `go.sum` to be created in a consistent way, which would help with reproducible builds.
Having documentation around it would help manage expectations around the behavior of how `go.sum` is populated under different scenarios.
One reason that know this is useful is that it was mentioned that `go.sum` is "kinda like a lockfile" and one should commit it to the vcs. Because it gets populated differently under different scenarios it's not clear to me _when_ should I commit it. After reading that `go mod tidy` ensures that [dependecies for all possible OS/arch combos](https://github.com/golang/go/wiki/Modules#why-does-go-mod-tidy-record-indirect-and-test-dependencies-in-my-gomod) are preset it seems to me that ideally one should commit `go.sum` only after running `go mod tidy`, otherwise some commands might generate local changes in that file.

### What did you see instead?

`go.sum` is created with different content depending on which dependencies from `go.mod` are imported.