v2.1.0: checksums are different between using GOPROXY=direct and GOPROXY=https://proxy.golang.org

sixg0000d commented 3 years ago

Problem statement

My system default go environment is GOPROXY=direct, when I import github.com/ameshkov/dnscrypt/v2/@v/v2.1.0 from other go package modules, it reports an error as below:

verifying github.com/ameshkov/dnscrypt/v2@v2.1.0: checksum mismatch
        downloaded: h1:kebi26kr5nFHbpy6JDCzLWQJ2Nqi5keaA5suR9H25hk=
        go.sum:     h1:Qk0sWc5Qe93uAWL0KUjLnH3UpKuQhr/LnxtfcNrhLWs=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

This does not happen when using GOPROXY=https://proxy.golang.org.

Steps to reproduce

~ $ go env GOPROXY
direct
~ $ go mod download -json github.com/ameshkov/dnscrypt/v2@v2.1.0
{
        "Path": "github.com/ameshkov/dnscrypt/v2",
        "Version": "v2.1.0",
        "Info": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.info",
        "GoMod": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.mod",
        "Zip": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.zip",
        "Dir": "/home/sixg0000d/go/pkg/mod/github.com/ameshkov/dnscrypt/v2@v2.1.0",
        "Sum": "h1:kebi26kr5nFHbpy6JDCzLWQJ2Nqi5keaA5suR9H25hk=",
        "GoModSum": "h1:+8SbPbVXpxxcUsgGi8eodkqWPo1MyNHxKYC8hDpqLSo="
}
~ $ go clean -modcache
~ $ export GOPROXY="https://proxy.golang.org,direct"
~ $ go env GOPROXY
https://proxy.golang.org,direct
~ $ go mod download -json github.com/ameshkov/dnscrypt/v2@v2.1.0
{
        "Path": "github.com/ameshkov/dnscrypt/v2",
        "Version": "v2.1.0",
        "Info": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.info",
        "GoMod": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.mod",
        "Zip": "/home/sixg0000d/go/pkg/mod/cache/download/github.com/ameshkov/dnscrypt/v2/@v/v2.1.0.zip",
        "Dir": "/home/sixg0000d/go/pkg/mod/github.com/ameshkov/dnscrypt/v2@v2.1.0",
        "Sum": "h1:Qk0sWc5Qe93uAWL0KUjLnH3UpKuQhr/LnxtfcNrhLWs=",
        "GoModSum": "h1:+8SbPbVXpxxcUsgGi8eodkqWPo1MyNHxKYC8hDpqLSo="
}
~ $

Simlar issues

Environment

go version: go1.16 OS: linux/amd64

ameshkov commented 3 years ago

Hmm, I did re-create tag v2.1.0, but the old one existed only for a couple of minutes, probably that was enough.

Please use v2.1.1

sixg0000d commented 3 years ago

Hmm, I did re-create tag v2.1.0, but the old one existed only for a couple of minutes, probably that was enough.

Please use v2.1.1

thanks

ameshkov / dnscrypt