andygrunwald / andygrunwald/go-jira

Don't change published version tags to avoid go module checksum mismatch

オープン
#326 コメント 3 件 リアクション 2 件 担当者 0 名 GitHub で見る
needs triage
主要言語
Go
スター
1.6k
フォーク
500
PR マージ指標
30日以内にマージされた PR はありません

説明

Recently it appears that the `v1.12.0` tag was moved to a different commit. https://github.com/andygrunwald/go-jira/tree/v1.12.0

This has caused breakage in any go code that was using this tag's previous location in their go.sum file.

```
$ go mod tidy
verifying github.com/andygrunwald/go-jira@v1.12.0: checksum mismatch
downloaded: h1:lf2Y3VFMuYNPbgAiLBHVDXYbmXrA4+/++7D6EFHK7xk=
go.sum: h1:JJi2cEDmDxVtTXxC8ruLDbtOU6pA4OLeL0niyfNcoWw=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
```

Changing a git tag is basically the equivalent to force-pushing a public branch and can cause breakage and headaches for anyone downstream. *Please please please avoid this in the future.* **Tags must be immutable.** The correct approach likely would have been to create a new tag: `v1.12.1`, assuming the change was a minor patch without altering functionality or API. No matter what, don't change a tag you have already pushed.

~Since the damage is done, I highly suggest just leaving it alone now and leaving this issue open for anyone else who runs into the above error. Changing the tag again, even back to where it was previously, will cause further headaches for users who have since applied the following fix.~ Edit: see my follow up comment below.

~The fix for downstream users is to simply remove the corresponding lines from their go.sum file, and clearing this module out of your module cache (`# rm -rf $(go env GOMODCACHE)/github.com/andygrunwald/go-jira@v1.12.0`) and allow it to be updated with the new checksum by running `go mod tidy`.~ Edit: see my follow up comment below.

If you are a downstream user and already have this module in your cache from before the tag was altered, then it won't be downloaded and the checksum will pass. But any new users who clone your repo will hit the above error.

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。