Go-micro: quic-go checksum mismatch ?

[xmlking]

any one come across this error when doing go mod download ?
I am seeing this error in docker builds

verifying github.com/lucas-clemente/[email protected]: checksum mismatch
    downloaded: h1:dYHUyB50gEQlK3KqytmNySzuyzAcaQ3iuI2ZReAfVrE=
    go.sum:     h1:TRbvZ6F++sofeGbh+Z2IIyIOhl8KyGnYuA06g2yrHdI=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

[vtolstov]

i'm not able to fix this via go mod magic, so i simply change hash sum inside go.sum file with provided
h1:dYHUyB50gEQlK3KqytmNySzuyzAcaQ3iuI2ZReAfVrE=

[x1unix]

Try to purge modules cache ($GOROOT/pkg) and go.sum file.

[mhconradt]

This library is causing me all sorts of trouble. I can fix it by changing the go.mod, but it goes without saying that's sketchy. Maybe there's a version of it that can be pinned that's ok.

[asim]

We have updated go.mod for go 1.13 and this issue should be fixed. In some cases it may require doing go clean -modcache.

[ka-ka]

Have anyone checked why the checksum have changed? Is it really the author of quic-go that changed the v0.12.0 release or ... someone else? Ruby have recently had problem with some support libraries that have been hijacked by hackers.

[milosgajdos]

We had discovered something interesting couple of day ago:
If go.mod refers to a specific version of Go then no matter what version of go you use locally you'll probably be served the checksums for the version of the Go in the go.sum.

Checksum seem to differ between go versions i.e. checksums for Go 1.13 is different from the checksum for the very same package for Go 1.12.

[AudriusButkevicius]

The bad checksum is a bug in go that was fixed in 1.13, I don't think it's the libraries fault.

[idoall]

the same error

bash-5.0# go env -w GO111MODULE=on
bash-5.0# go get -v github.com/micro/go-micro
go: finding github.com/micro/go-micro v1.11.1
go: downloading github.com/micro/go-micro v1.11.1
go: extracting github.com/micro/go-micro v1.11.1
go: downloading github.com/pkg/errors v0.8.1
go: downloading github.com/google/uuid v1.1.1
go: downloading github.com/micro/mdns v0.3.0
go: downloading golang.org/x/net v0.0.0-20190724013045-ca1201d0de80
go: downloading github.com/micro/cli v0.2.0
go: downloading github.com/golang/protobuf v1.3.2
go: downloading github.com/nats-io/nats.go v1.8.1
go: downloading github.com/go-log/log v0.1.0
go: downloading github.com/lucas-clemente/quic-go v0.12.0
go: extracting github.com/pkg/errors v0.8.1
go: downloading github.com/hashicorp/memberlist v0.1.4
go: extracting github.com/go-log/log v0.1.0
go: downloading google.golang.org/grpc v1.22.1
go: extracting github.com/micro/mdns v0.3.0
go: extracting github.com/google/uuid v1.1.1
go: downloading github.com/miekg/dns v1.1.15
go: extracting github.com/micro/cli v0.2.0
go: extracting github.com/nats-io/nats.go v1.8.1
go: extracting github.com/hashicorp/memberlist v0.1.4
go: downloading github.com/armon/go-metrics v0.0.0-20190430140413-ec5e00d3c878
go: extracting github.com/armon/go-metrics v0.0.0-20190430140413-ec5e00d3c878
go: extracting github.com/miekg/dns v1.1.15
go: downloading github.com/hashicorp/go-sockaddr v1.0.2
go: extracting github.com/golang/protobuf v1.3.2
go: downloading golang.org/x/sys v0.0.0-20190812073006-9eafafc0a87e
go: downloading golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4
verifying github.com/lucas-clemente/[email protected]: checksum mismatch
    downloaded: h1:dYHUyB50gEQlK3KqytmNySzuyzAcaQ3iuI2ZReAfVrE=
    sum.golang.org: h1:TRbvZ6F++sofeGbh+Z2IIyIOhl8KyGnYuA06g2yrHdI=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

[SergeySkyline]

i'm not able to fix this via go mod magic, so i simply change hash sum inside go.sum file with provided
h1:dYHUyB50gEQlK3KqytmNySzuyzAcaQ3iuI2ZReAfVrE=

@vtolstov amazing! cant believe this finally works thanks to your advice. Wish tons of free food upon you

[vtolstov]

=) simply - don't use go get -u

[jeffcai]

i just remove all contents in the go.sum file and run command again, the issue is gone.