Swag: Cannot update to 1.6.6: checksum mismatch

[kolaente]

Describe the bug
I can't update to version 1.6.6.

To Reproduce

go get -u github.com/swaggo/swag

will return the following error message:

go: downloading github.com/swaggo/swag v1.6.6
verifying github.com/swaggo/[email protected]: checksum mismatch
        downloaded: h1:ujSziE+CfBxr5eIsVJgjGNbDxq1zPfLHxlu5NJmRFSQ=
        sum.golang.org: h1:3YX5hmuUyCMT/OqqnjW92gULAfHg3hVjpcPm53N64RY=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Expected behavior

Package updates without issues.

Your swag version
1.6.6

Your go version
go version go1.13.5 linux/amd64

[kolaente]

I'm not sure if this could be a caching issue as pkg.go.dev lists version 1.6.6 as published 4 days ago but github says it was released 25min ago.

[Terminator637]

Yes, I got the same issue.

[phpinfo]

Got the same issue

[petrwl]

I got the same bug

[0xERR0R]

Same bug, I had also this error some days ago: https://github.com/swaggo/swag/issues/705#issuecomment-632536163

Is it possible, that release 1.6.6 was "released" twice? 4 days ago and yesterday?

[sdowding]

I'm still getting this error:

go: verifying github.com/swaggo/[email protected]: checksum mismatch
    downloaded: h1:ujSziE+CfBxr5eIsVJgjGNbDxq1zPfLHxlu5NJmRFSQ=
    go.sum:     h1:3YX5hmuUyCMT/OqqnjW92gULAfHg3hVjpcPm53N64RY=

and https://sum.golang.org/lookup/github.com/swaggo/[email protected] is reporting:

1220875
github.com/swaggo/swag v1.6.6 h1:3YX5hmuUyCMT/OqqnjW92gULAfHg3hVjpcPm53N64RY=
github.com/swaggo/swag v1.6.6/go.mod h1:xDhTyuFIujYiN3DKWC/H/83xcfHp+UE/IzWWampG7Zc=

go.sum database tree
1253168
wEBZPSAlwe1/nLHtKJ1zgPIbfM7ddW0lE/Y9/v2RwPA=

— sum.golang.org Az3grnPzZfF+VG1m50fYtJevjUb7crmKhyohBy00SkbeiwhsBBbZpqwWfVWdfMvKTwAmrd1KeHS+A1QTaWEj5VvvwgE=

is there a way around this? Does there need to be a new release?

[kolaente]

@easonlin404 Any chance this will be fixed?

[sdowding]

@easonlin404 @sdghchj I think it just needs a new release tag for v1.6.7 to resolve the sum issue...

[easonlin404]

Hey guys @kolaente @sdowding I just now try it and it's work for me:

 ~ export GO111MODULE=on                                               
➜  ~ go get -u github.com/swaggo/swag                                                                                                                          
go: finding github.com/swaggo/swag v1.6.6                                                                                                                      
go: finding github.com/alecthomas/template latest                              
go: finding github.com/swaggo/files latest                                     
go: finding golang.org/x/tools latest
... omit above                                        

could you help try again to confirm the issue?

[sdghchj]

@easonlin404 I guess they opened env GOPROXY to pull from a proxy-server where old v1.6.6 was cached.

[easonlin404]

@easonlin404 I guess they opened env GOPROXY to pull from a proxy-server where old v1.6.6 was cached.

@kolaente @sdowding @0xERR0R Have you guys set GOPROXY env?

[0xERR0R]

@easonlin404 : GOPROXY is not set, just rerun the build again, same error:

verifying github.com/swaggo/[email protected]: checksum mismatch
    downloaded: h1:3YX5hmuUyCMT/OqqnjW92gULAfHg3hVjpcPm53N64RY=
    go.sum:     h1:ujSziE+CfBxr5eIsVJgjGNbDxq1zPfLHxlu5NJmRFSQ=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

[sdghchj]

Try following cmds:

$ go clean -modcache
$ rm go.sum
$ go mod tidy

[0xERR0R]

@sdghchj The job runs always in a "fresh box" with clean checkout: https://github.com/0xERR0R/blocky/blob/master/.github/workflows/ci-build.yml and executes go get -v -t -d ./...

[kolaente]

@easonlin404 Nope, still does not work.

Have you guys set GOPROXY env?

I have it set to direct.

You should be able to verify with

$ GOPROXY=direct go get -u github.com/swaggo/swag

go: github.com/swaggo/swag upgrade => v1.6.6
github.com/swaggo/[email protected]: verifying module: checksum mismatch
        downloaded: h1:ujSziE+CfBxr5eIsVJgjGNbDxq1zPfLHxlu5NJmRFSQ=
        sum.golang.org: h1:3YX5hmuUyCMT/OqqnjW92gULAfHg3hVjpcPm53N64RY=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

It kinda works with go get -u github.com/swaggo/swag -insecure but that's not a solution.

The job runs always in a "fresh box" with clean checkout

Probably because there is no go.sum with a wrong checksum. I just won't be able to update the version of it in my project. I've just verified, there is no checksum for 1.6.6 in my go.sum since it is the new version.

There just seems to be a wrong checksum at sum.golang.org.

[0xERR0R]

If I query https://index.golang.org/index?since=2020-05-20T01:08:52.997264Z, I get
{"Path":"github.com/swaggo/swag","Version":"v1.6.6","Timestamp":"2020-05-20T10:23:53.934741Z"}. According to this information, 1.6.6 was released on 20 May. Github release is from 24 May, this issue too. But see my comment above (https://github.com/swaggo/swag/issues/712#issuecomment-633597887) I had another problem with 1.6.6 some days earlier

[sdowding-koho]

@easonlin404 i still get this error... i think the only way to resolve it is to make a new release tag so the go proxy will re-index its checksum.

Depending on your local cache you may be able to pull locally if you pulled the original 1.6.6 build

[easonlin404]

I've just released v1.6.7 Please try the latest, thanks.

[0xERR0R]

no problems with 1.6.7. Thanks for your work! 👍

[sdowding-koho]

thanks!

[ghost]

@easonlin404

Hi there, Just wanted to know that if I want to update swag version to 1.7.0 in my project, how can I generate the checksum value used in my go.sum file?
Earlier my project was using 1.6.7 version and now it has been updated to 1.7.0...so after adding newer version...I am getting a checksum mismatch error.