search

gavv / httpexpect

End-to-end HTTP and REST API testing for Go.
https://pkg.go.dev/github.com/gavv/httpexpect/v2
MIT License
2.56k stars 239 forks source link

Wrong module checksum #99

Closed sylvain-p85 closed 3 years ago

sylvain-p85 commented 3 years ago

Httpexpect requires module github.com/fasthttp/websocket v1.4.2. But the version 1.4.2 has been re-uploaded by its author. This has introduced some failures while using httpexpect: 

github.com/fasthttp/websocket@v1.4.2: verifying module: checksum mismatch
        downloaded: h1:hTnl0DRQ9Tj4uVc4QcZCGp+mgF5mVKnijR1eNyn2waY=
        sum.golang.org: h1:AU/zSiIIAuJjBMf5o+vO0syGOnEfvZRu40xIhW/3RuM=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Is it possible for you to release a new version with the last github.com/fasthttp/websocket version ? Thx.

sylvain-p85 commented 3 years ago

May I have a reply plz ? This error is quite annoying.

gavv commented 3 years ago

Hi, sorry for late reply.

Strangely I can't reproduce it. Neither after cleaning all caches, nor in a fresh environment in docker.

Anyway, I've bumped fasthttp/websocket to 1.4.3 and pushed this to master and v2. Also tagged a new release v2.3.0.

FlorianLoch commented 3 years ago

I also ran into this, but only in CI. So therefore I am quite sure it's caused by intermediate go proxies like Athens that recognize the version (because it's in their cache) but are not happy with the checksum.

But good to see it's fixed now 💪

bykof commented 3 years ago

I get an error installing httpexpect: 

go get: github.com/gavv/httpexpect/v2@v2.2.0 updating to
        github.com/gavv/httpexpect/v2@v2.3.0 requires
        github.com/fasthttp/websocket@v1.4.3: reading github.com/fasthttp/websocket/go.mod at revision v1.4.3: unknown revision v1.4.3

looks like fasthttp/websocket doesn't have a git tag v1.4.3: https://github.com/fasthttp/websocket/tags

gavv commented 3 years ago

Sorry for delay. So they removed the tag again... I'll take a look.

gavv commented 3 years ago

Should be fixed in master, v2, and v2.3.1.