//     [ 1](sec  1)(fl 0x00)(ty   0)(scl   3) (nx 1) 0x00000000 .rsrc$01
//     AUX scnlen 0x68 nreloc 1 nlnno 0 checksum 0x0 assoc 0 comdat 0
//     [ 3](sec  2)(fl 0x00)(ty   0)(scl   3) (nx 1) 0x00000000 .rsrc$02
//     AUX scnlen 0x18 nreloc 0 nlnno 0 checksum 0x0 assoc 0 comdat 0
//     [ 5](sec  2)(fl 0x00)(ty   0)(scl   3) (nx 0) 0x00000000 $R000000
//     RELOCATION RECORDS FOR [.rsrc$01]:

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package sumdb implements the HTTP protocols for serving or accessing a module checksum database.
package sumdb

import (
	"context"
	"net/http"
	"os"
	"strings"

	"golang.org/x/mod/internal/lazyregexp"
	"golang.org/x/mod/module"
	"golang.org/x/mod/sumdb/tlog"
)

	{
		"truncated empty",
		"",
		[]byte{},
		nil,
		io.ErrUnexpectedEOF,
	},
	{
		"truncated dict",
		"",
		[]byte{0x78, 0xbb},
		[]byte{0x00},
		io.ErrUnexpectedEOF,
	},
	{
		"truncated checksum",
		"",
		[]byte{0x78, 0xbb, 0x00, 0x01, 0x00, 0x01, 0xca, 0x48,
			0xcd, 0xc9, 0xc9, 0xd7, 0x51, 0x28, 0xcf, 0x2f,
			0xca, 0x49, 0x01, 0x04, 0x00, 0x00, 0xff, 0xff,
		},
		[]byte{0x00},
		io.ErrUnexpectedEOF,

	// ones. See https://golang.org/issue/45965.
	SeparateIndirectVersion = "1.17"

	// tidyGoModSumVersion is the Go version at which
	// 'go mod tidy' preserves go.mod checksums needed to build test dependencies
	// of packages in "all", so that 'go test all' can be run without checksum
	// errors.
	// See https://go.dev/issue/56222.
	TidyGoModSumVersion = "1.21"

	// goStrictVersion is the Go version at which the Go versions

	0x02f7, 0x0000, 0x02f9, 0x02f9, 0x02f9, 0x02f9, 0x02f9, 0x0000,
	// Entry 300 - 33F
	0x02ff, 0x0300, 0x02ff, 0x0000, 0x0303, 0x0051, 0x00e6,
} // Size: 1574 bytes

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package dirhash defines hashes over directory trees.
// These hashes are recorded in go.sum files and in the Go checksum database,
// to allow verifying that a newly-downloaded module has the expected content.
package dirhash

import (
	"archive/zip"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"
	"io"
	"os"

https://golang.org/doc/tutorial/create-module.

For a detailed reference on modules, see https://golang.org/ref/mod.

By default, the go command may download modules from https://proxy.golang.org.
It may authenticate modules using the checksum database at
https://sum.golang.org. Both services are operated by the Go team at Google.
The privacy policies for these services are available at
https://proxy.golang.org/privacy and https://sum.golang.org/privacy,
respectively.

		// should be considered up-to-date. The fix for now is to always treat the
		// go.sum as up-to-date during list -m -u. Probably the right fix is more targeted,
		// but in general list -u is looking up other checksums in the checksum database
		// that won't be necessary later, so it makes sense not to write the go.sum back out.
		if !ExplicitWriteGoMod && mode&ListU == 0 {
			err = commitRequirements(ctx, WriteOpts{})
		}
	}

are retained as explicit requirements in the go.mod file.
(Go versions 1.17 and higher retain more requirements in order to
support lazy module loading.)

The -compat flag preserves any additional checksums needed for the
'go' command from the indicated major Go release to successfully load
the module graph, and causes tidy to error out if that version of the
'go' command would load any imported package from a different module