Go: cmd/go: checksum mismatch lacks resolution information

[iand]

What version of Go are you using (go version)?

$ go version

go version devel +5f45a3337e Wed Aug 14 19:49:15 2019 +0000 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env

GO111MODULE="auto"

GOARCH="amd64"

GOBIN=""

GOCACHE="/home/iand/.cache/go-build"

GOENV="/home/iand/.config/go/env"

GOEXE=""

GOFLAGS=""

GOHOSTARCH="amd64"

GOHOSTOS="linux"

GONOPROXY=""

GONOSUMDB=""

GOOS="linux"

GOPATH="/home/iand"

GOPRIVATE=""

GOPROXY="https://proxy.golang.org,direct"

GOROOT="/opt/go"

GOSUMDB="sum.golang.org"

GOTMPDIR=""

GOTOOLDIR="/opt/go/pkg/tool/linux_amd64"

GCCGO="gccgo"

AR="ar"

CC="gcc"

CXX="g++"

CGO_ENABLED="1"

GOMOD="/home/iand/wip/--elided---/go.mod"

CGO_CFLAGS="-g -O2"

CGO_CPPFLAGS=""

CGO_CXXFLAGS="-g -O2"

CGO_FFLAGS="-g -O2"

CGO_LDFLAGS="-g -O2"

PKG_CONFIG="pkg-config"

GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build133450829=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Ran go mod tidy

What did you expect to see?

Instructions for investigating the cause and potential resolution of a checksum mismatch.

What did you see instead?

10:24 $ go mod tidy
verifying [email protected]+incompatible: checksum mismatch
    downloaded: h1:y0IMTfclpMdsdIbr6uwmJn5/WZ7vFuObxDMdrylFM3A=
    sum.golang.org: h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

This information, while correct, is not very informative for most users. It tells them the problem but doesn't indicate how they can resolve it. Their build will not progress until they resolve the problem.

go help module-auth provides very detailed information on the operation of the module checksum mechanism but doesn't help the typical user get their build working.

In my case go clean -modcache solved my problem although I am left with the feeling that I just did the module analog of "switching it off and on again".

The message would be more informative if it told me where the downloaded code is and how I can cross reference that with the code the checksum server saw.

[mvdan]

/cc @bcmills @jayconrod

[hyangah]

The same problem caused me to vote for go mod clean -m extension proposal in #28835

[im-kulikov]

The same problem with go1.13 and some repos (https://github.com/panjf2000/ants/issues/49)

[eaardal]

$ go version
go version go1.13 darwin/amd64

Same issue, solved with go clean -modcache, but as mentioned the error message really needs to specify more clearly how to get the build working again

[BensamV]

Thanks @eaardal