cmd/go: do not embed checksums when building with vendor

Fixes #46400

Tested: Ran go test cmd/go
Change-Id: I60655129c55d40a70a13ed23937ef990f315fd73
Cq-Include-Trybots: luci.golang.try:gotip-linux-amd64-longtest,gotip-windows-amd64-longtest
Reviewed-on: https://go-review.googlesource.com/c/go/+/564195
Reviewed-by: Bryan Mills <bcmills@google.com>
Run-TryBot: Sam Thanawalla <samthanawalla@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Commit-Queue: Sam Thanawalla <samthanawalla@google.com>

src/cmd/go/internal/load/pkg.go

@@ -2306,7 +2306,7 @@ func (p *Package) setBuildInfo(ctx context.Context, autoVCS bool) {
 		}
 		if mi.Replace != nil {
 			dm.Replace = debugModFromModinfo(mi.Replace)
-		} else if mi.Version != "" {
+		} else if mi.Version != "" && cfg.BuildMod != "vendor" {
 			dm.Sum = modfetch.Sum(ctx, module.Version{Path: mi.Path, Version: mi.Version})
 		}
 		return dm

src/cmd/go/testdata/script/mod_gomodcache_vendor.txt

@@ -0,0 +1,32 @@
+# This test verifies that GOMODCACHE does not affect whether checksums are embedded
+# with vendored files.
+# See issue #46400
+[short] skip 'builds and links a binary twice'
+go mod tidy
+go mod vendor
+
+go build -mod=vendor
+go version -m example$GOEXE
+cp stdout version-m.txt
+
+env GOMODCACHE=$WORK${/}modcache
+go build -mod=vendor
+go version -m example$GOEXE
+cmp stdout version-m.txt
+
+-- go.mod --
+module example
+go 1.22
+require rsc.io/sampler v1.3.0
+
+-- main.go --
+package main
+
+import (
+    "fmt"
+    "rsc.io/sampler"
+)
+
+func main() {
+    fmt.Println(sampler.Hello())
+}