Checksum mismatch for go 1.13

[im-kulikov]

Expect (go version go1.12.9 darwin/amd64):

→ go mod tidy -v
go: downloading github.com/panjf2000/ants v1.2.0
go: extracting github.com/panjf2000/ants v1.2.0

Actual (go version go1.13 darwin/amd64)

→ go mod tidy -v
verifying github.com/panjf2000/[email protected]: checksum mismatch
        downloaded: h1:Ufw4aDz9RqH1RVblx2W9L9Uv5vSX5apbX5+peR7LQ5k=
        sum.golang.org: h1:pMQ1/XpSgnWx3ro4y1xr/uA3jXUsTuAaU3Dm0JjwggE=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

---

UPD: mb this issue will be useful - golang/go#33665

---

UPD: how resolve issue step by step (macOS):

• sudo go clean -modcache
• git checkout go.sum
• go mod tidy -v

---

UPD for Linux:

• cd /another/path
• go clean -modcache
• cd /project/path
• go mod tidy

[panjf2000]

@im-kulikov
Thanks for reporting this issue and providing the solution, it seems that go clean -modcache is the only way to resolve this issue for now, right?
But still, I don't know why this is happening, do you? by any chance?

[im-kulikov]

@im-kulikov
Thanks for reporting this issue and providing the solution, it seems that go clean -modcache is the only way to resolve this issue, right?
But still, I don't know why this is happening, do you? by any chance?

@panjf2000 yeah, this solution works for me (macOS), for Linux:

• cd /another/path
• go clean -modcache
• cd /project/path
• go mod tidy

But still, I don't know why this is happening, do you? by any chance?

something similar has already happened with go1.10 and go1.11

I attached issue from golang repo, mb someone can help with additional info

[panjf2000]

Got it, thanks~

[panjf2000]

There is a fundamental solution to this kind of issue:

# Remove go.sum
rm go.sum

# Then re-generate go.sum
go mod tidy

[im-kulikov]

@panjf2000 but on other computers, you will receive this bug again..

[panjf2000]

@im-kulikov
What did you mean? Removing go.sum still didn't work?

[im-kulikov]

No, because problem is with go-modules..
Solution:

• cleanup $GOPATH/pkg/mod
• cleanup $GOPATH/pkg/sumdb
• go mod download
• replace hash in go.sum

[r6c]

still not work on Windows go 1.13.3

[r6c]

go: downloading github.com/panjf2000/ants v1.2.0
go: downloading github.com/panjf2000/ants/v2 v2.2.2
verifying github.com/panjf2000/[email protected]: checksum mismatch
        downloaded: h1:Ufw4aDz9RqH1RVblx2W9L9Uv5vSX5apbX5+peR7LQ5k=
        sum.golang.org: h1:pMQ1/XpSgnWx3ro4y1xr/uA3jXUsTuAaU3Dm0JjwggE=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

[panjf2000]

It seems that you are trying to download both v1 and v2 of ants? Why did you do that?
And removing go.sum didn't work?

[patrick-othmer]

Important thing: Close your IDE! I had that problem with GoLand. Close IDE and repeat the steps:
cd /another/path
go clean -modcache
cd /project/path
go mod tidy

[panjf2000]

Fixed in #168