hashicorp / hashicorp/consul

SECURITY ERROR: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch

Open
#23,260 4 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

`go get github.com/hashicorp/consul/api` has a bad checksum that is now present when `GOPROXY=direct` only. Looks like a bad release in `v1.33.3`. Please can you fix ASAP.

```
go: downloading github.com/hashicorp/consul/api v1.33.3
go: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch
downloaded: h1:XLKUXPJb9foOI2npcv+1lTgV0YpA71wvvkuh+59NQXY=
sum.golang.org: h1:6ttDO8Os/lqwaus7nJxJaeiUw2o7GWKoQ1jexAFPdEQ=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the github.com/hashicorp/consul/api v1.33.3 download with GOPROXY=direct and compare it with the checksum reported by sum.golang.org. No repository file or test is identified; the issue is done when the published module artifact and its verified checksum agree.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.