SECURITY ERROR: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
`go get github.com/hashicorp/consul/api` has a bad checksum that is now present when `GOPROXY=direct` only. Looks like a bad release in `v1.33.3`. Please can you fix ASAP.
```
go: downloading github.com/hashicorp/consul/api v1.33.3
go: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch
downloaded: h1:XLKUXPJb9foOI2npcv+1lTgV0YpA71wvvkuh+59NQXY=
sum.golang.org: h1:6ttDO8Os/lqwaus7nJxJaeiUw2o7GWKoQ1jexAFPdEQ=
SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
For more information, see 'go help module-auth'.
```
Contributor guide
Research direction
Start by reproducing the github.com/hashicorp/consul/api v1.33.3 download with GOPROXY=direct and compare it with the checksum reported by sum.golang.org. No repository file or test is identified; the issue is done when the published module artifact and its verified checksum agree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100