cmd/go: go module does not work as expected, reports 'checksum mismatch'

[daixiang0]

With a env with GOPATH and download many pkgs:

$ go get -d github.com/improbable-eng/thanos/...
$ cd ${GOPATH}/src/github.com/improbable-eng/thanos
$ make
go: verifying github.com/grpc-ecosystem/go-grpc-middleware@v1.0.0: checksum mismatch
    downloaded: h1:BWIsLfhgKhV5g/oF34aRjniBHLTZe5DNekSjbAjIS6c=
    go.sum:     h1:Iju5GlWwrvL6UBg4zJJt3btmonfrMlCDdsejg4CZE7c=
Makefile:183: recipe for target 'go-mod-tidy' failed

What version of Go are you using (go version)?

$ go version
go version go1.11 linux/amd64

reproduce with follow cmd:

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/deploy/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/golang"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/golang/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build796150416=/tmp/go-build -gno-record-gcc-switches"

unset GOPATH, make works.

[thepudds]

@daixiang0 If you review the symptoms and workaround described in https://github.com/golang/go/issues/29278#issuecomment-447537558 and https://github.com/golang/go/issues/29278#issuecomment-447571410, does it look like you might be seeing #29278?

[daixiang0]

@thepudds clean mod cache does not work for me

[root@dx-test thanos]# go clean -modcache
[root@dx-test thanos]# make
>> formatting code
dgo: downloading github.com/stretchr/testify v1.2.2
go: downloading github.com/grpc-ecosystem/go-grpc-prometheus v0.0.0-20181025070259-68e3a13e4117
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.0.0
go: downloading github.com/go-stack/stack v1.8.0
go: downloading github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515
go: downloading gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127
go: downloading github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72
go: downloading github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c
go: downloading github.com/google/go-cmp v0.2.0
go: downloading github.com/hashicorp/go-uuid v1.0.0
go: downloading labix.org/v2/mgo v0.0.0-20140701140051-000000000287
go: downloading github.com/OneOfOne/xxhash v1.2.2
go: verifying github.com/grpc-ecosystem/go-grpc-middleware@v1.0.0: checksum mismatch
        downloaded: h1:BWIsLfhgKhV5g/oF34aRjniBHLTZe5DNekSjbAjIS6c=
        go.sum:     h1:Iju5GlWwrvL6UBg4zJJt3btmonfrMlCDdsejg4CZE7c=

[daixiang0]

@thepudds any input?

[jayconrod]

@daixiang0 You mentioned in your original report that you're on Go 1.11. In Go 1.11.4, there was a change to the way we compute the hashes that go into go.sum. These are the issues that @thepudds linked to.

It's very likely that this go.sum file was written with a Go version after 1.11.4, so they have the new hashes, but your installed Go binary is still producing the old hashes. Could you try upgrading to 1.11.4 or newer?

Failing that, could you please run go mod download -json github.com/grpc-ecosystem/go-grpc-middleware@v1.0.0 and confirm the value you're seeing for Sum? I'm seeing h1:Iju5GlWwrvL6UBg4zJJt3btmonfrMlCDdsejg4CZE7c= with Go 1.12.1, which is the same as what's in the go.sum file.

(The change in hashes was an unforeseen consequence, and definitely something we'll avoid in the future, but we can't go back and change 1.11.4 at this point).

[daixiang0]

@jayconrod thanks very much, after upgrade it works.

[daixiang0]

@jayconrod another question, why unset GOPATH can work?

[jayconrod]

@daixiang0 Glad to hear. I'll close this.

GOPATH doesn't need to be set explicitly whether or not module mode is enabled. It defaults to $HOME/go (you can check the effective value with go env GOPATH). In module mode, GOPATH is only used to store the module cache (in $GOPATH/pkg/mod). The contents of $GOPATH/src are ignored.

[daixiang0]

@jayconrod Thanks you again!