What version of Go are you using (go version)?

$ go version
go version go1.11.4 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/steb/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/steb/projects/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/run/user/1000/tmp/go-build023848120=/tmp/go-build -gno-record-gcc-switches"

What did you do?

1. Ran go mod download -json.
2. Bundled up all files listed in the JSON output (adding /list files as needed).
3. Tried to replay this bundle, using an HTTP server as a GOPROXY.

What did you expect to see?

go build, go mod download should work without fetching anything.

What did you see instead?

go build and go mod download is getting 404 errors due to files missing from the bundle. It looks like go build is trying to fetch:

1. Packages mentioned in go.sum files that aren't actually needed for the build (as far as I can tell, at least).
2. Older (minor) versions of packages mentioned in some dependencies' go.mod files.

I'd expect go mod download -json to return a list of every downloaded package.

Context: I'm trying to integrate go mod with IPFS.

• Dead-simple (but easy to read) bash implementation: https://gist.github.com/Stebalien/7bfd1ea07f81c1fbbe9eadac4faeccd3
• Slightly better (but more complicated) go implementation: https://github.com/Stebalien/ipgo/blob/master/main.go

Testing against: https://github.com/anacrolix/torrent/tree/ipgo