title: go.sum are different when using go mod vendor/download
body: <p>I have a problem with the usage of commands <code>go mod vendor</code> and <code>go mod download</code> in a go module.</p>
  <p>When I'm using <code>go mod vendor</code>, the generated go.sum has extra-lines. E.g, when I'm using <code>go mod download</code>, the <code>go.sum</code> contains:</p>
  <pre><code>github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
  </code></pre>
  <p>However if I remove the <code>go.sum</code> and run <code>go mod vendor</code>, I have 2 lines:</p>
  <pre><code>github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
  github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
  </code></pre>
  <p>This is problematic because if I commit the <code>go.sum</code> after running <code>go mod vendor</code>, any further <code>go mod download</code> (which may be used by someone else or in CI) will not work because of mismatching hashes which lead to a security issue.</p>
  <p>Is there something I'm doing wrong in the usage of <code>go mod vendor</code> and <code>go mod download</code>? Why would they produce different hashes in the <code>go.sum</code>?</p>
  <p>Here is the kind of error which instantly happens:</p>
  <pre><code>verifying xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@v0.1.0: checksum mismatch
       downloaded: h1:tIKKCv/bUyBNvVsB6YLo0Ds9ZFdGJ0FKkFun22nwvCI=
       go.sum:     h1:qta5K5jjJg+TnsD76tcFK7Bjf402WP9MIbPsJGU11Ms=
  
  SECURITY ERROR
  This download does NOT match an earlier download recorded in go.sum.
  The bits may have been replaced on the origin server, or an attacker may
  have intercepted the download attempt.
  </code></pre>
  <p>(Note: I replaced the name of the package by xxx because it carries my company name)</p>