dapr / dapr/go-sdk

Dapr 1.9.1 Checksum mismatch

Open
#474 5 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
479
Forks
187
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When building a docker container with go we have a step which calls `go mod download`. We are getting the following error:
```console
#11 [builder 6/9] RUN go mod download
#11 7.066 verifying github.com/dapr/go-sdk@v1.9.1: checksum mismatch
#11 7.066 downloaded: h1:f5gV8HtGz6iBJSsh6eI+/Ews4sGC3W9gX0/oD9ANVqM=
#11 7.066 go.sum: h1:SwfLYwqFwBNn1B8pCzGGG49utjV3oMQLZOlOkmf63T8=
#11 7.066
#11 7.066 SECURITY ERROR
#11 7.066 This download does NOT match an earlier download recorded in go.sum.
#11 7.066 The bits may have been replaced on the origin server, or an attacker may
#11 7.066 have intercepted the download attempt.
#11 7.066
#11 7.066 For more information, see 'go help module-auth'.
#11 ERROR: process "/bin/sh -c go mod download" did not complete successfully: exit code: 1
```

**To Reproduce**

- Have an application with an earlier version of the Dapr SDK in your go.mod file
- Update to Dapr 1.9.1

**Expected behavior**

- Not get a checksum mismatch when updating Dapr.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported update from an earlier SDK version to Dapr 1.9.1 and run `go mod download` in the affected application. Inspect the `go.mod` and `go.sum` entries alongside the downloaded checksum; the issue is done when updating to 1.9.1 completes without a checksum mismatch.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.