andygrunwald / andygrunwald/go-jira
Don't change published version tags to avoid go module checksum mismatch
- 主要言語
- Go
- スター
- 1.6k
- フォーク
- 500
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
Recently it appears that the `v1.12.0` tag was moved to a different commit. https://github.com/andygrunwald/go-jira/tree/v1.12.0
This has caused breakage in any go code that was using this tag's previous location in their go.sum file.
```
$ go mod tidy
verifying github.com/andygrunwald/go-jira@v1.12.0: checksum mismatch
downloaded: h1:lf2Y3VFMuYNPbgAiLBHVDXYbmXrA4+/++7D6EFHK7xk=
go.sum: h1:JJi2cEDmDxVtTXxC8ruLDbtOU6pA4OLeL0niyfNcoWw=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
For more information, see 'go help module-auth'.
```
Changing a git tag is basically the equivalent to force-pushing a public branch and can cause breakage and headaches for anyone downstream. *Please please please avoid this in the future.* **Tags must be immutable.** The correct approach likely would have been to create a new tag: `v1.12.1`, assuming the change was a minor patch without altering functionality or API. No matter what, don't change a tag you have already pushed.
~Since the damage is done, I highly suggest just leaving it alone now and leaving this issue open for anyone else who runs into the above error. Changing the tag again, even back to where it was previously, will cause further headaches for users who have since applied the following fix.~ Edit: see my follow up comment below.
~The fix for downstream users is to simply remove the corresponding lines from their go.sum file, and clearing this module out of your module cache (`# rm -rf $(go env GOMODCACHE)/github.com/andygrunwald/go-jira@v1.12.0`) and allow it to be updated with the new checksum by running `go mod tidy`.~ Edit: see my follow up comment below.
If you are a downstream user and already have this module in your cache from before the tag was altered, then it won't be downloaded and the checksum will pass. But any new users who clone your repo will hit the above error.
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。