I am at c034d4fae1d604adbb5ff98034cad138eab3a771 fwiw
$ go build -v -a
go: downloading google.golang.org/grpc v1.16.0
verifying github.com/hashicorp/go-rootcerts@v0.0.0-20160503143440-6bb64b370b90: checksum mismatch
downloaded: h1:9HVkPxOpo+yO93Ah4yrO67d/qh0fbLLWbKqhYjyHq9A=
go.sum: h1:VBj0QYQ0u2MCJzBfeYXGexnAl17GsH1yidnoxCqqD9E=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
For more information, see 'go help module-auth'.
I am at c034d4fae1d604adbb5ff98034cad138eab3a771 fwiw