v2.1.0: checksums are different between using GOPROXY=direct and GOPROXY=https://proxy.golang.org
sixg0000d opened this issue · comments
sixg0000d commented
Problem statement
My system default go environment is GOPROXY=direct
, when I import github.com/ameshkov/dnscrypt/v2/@v/v2.1.0
from other go package modules, it reports an error as below:
verifying github.com/ameshkov/dnscrypt/v2@v2.1.0: checksum mismatch
downloaded: h1:kebi26kr5nFHbpy6JDCzLWQJ2Nqi5keaA5suR9H25hk=
go.sum: h1:Qk0sWc5Qe93uAWL0KUjLnH3UpKuQhr/LnxtfcNrhLWs=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
This does not happen when using GOPROXY=https://proxy.golang.org
.
Steps to reproduce
~ $ go env GOPROXY
direct
~ $ go mod download -json github.com/ameshkov/dnscrypt/v2@v2.1.0
{
"Path": "github.com/ameshkov/dnscrypt/v2",
"Version": "v2.1.0",
"Info": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.info",
"GoMod": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.mod",
"Zip": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.zip",
"Dir": "/home/sixg0000d/go/pkg/mod/github.com/ameshkov/dnscrypt/v2@v2.1.0",
"Sum": "h1:kebi26kr5nFHbpy6JDCzLWQJ2Nqi5keaA5suR9H25hk=",
"GoModSum": "h1:+8SbPbVXpxxcUsgGi8eodkqWPo1MyNHxKYC8hDpqLSo="
}
~ $ go clean -modcache
~ $ export GOPROXY="https://proxy.golang.org,direct"
~ $ go env GOPROXY
https://proxy.golang.org,direct
~ $ go mod download -json github.com/ameshkov/dnscrypt/v2@v2.1.0
{
"Path": "github.com/ameshkov/dnscrypt/v2",
"Version": "v2.1.0",
"Info": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.info",
"GoMod": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.mod",
"Zip": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.zip",
"Dir": "/home/sixg0000d/go/pkg/mod/github.com/ameshkov/dnscrypt/v2@v2.1.0",
"Sum": "h1:Qk0sWc5Qe93uAWL0KUjLnH3UpKuQhr/LnxtfcNrhLWs=",
"GoModSum": "h1:+8SbPbVXpxxcUsgGi8eodkqWPo1MyNHxKYC8hDpqLSo="
}
~ $
Simlar issues
Environment
go version: go1.16
OS: linux/amd64
Andrey Meshkov commented
Hmm, I did re-create tag v2.1.0, but the old one existed only for a couple of minutes, probably that was enough.
Please use v2.1.1
sixg0000d commented
Hmm, I did re-create tag v2.1.0, but the old one existed only for a couple of minutes, probably that was enough.
Please use
v2.1.1
thanks