[GODRIVER-2403] v1.9.0 verifying module: checksum mismatch Created: 03/May/22  Updated: 18/May/22  Resolved: 18/May/22

Status: Closed
Project: Go Driver
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: George King Assignee: Benji Rewis (Inactive)
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Documentation Changes: Not Needed

 Description   

Summary

go get mongo-driver checksum mismatch.

How to Reproduce

go get go.mongodb.org/mongo-driver/mongo
 
or 
 
go get go.mongodb.org/mongo-driver/mongo@v1.9.0   
 
go: downloading go.mongodb.org/mongo-driver v1.9.0
go: go.mongodb.org/mongo-driver/mongo@v1.9.0: go.mongodb.org/mongo-driver@v1.9.0: verifying module: checksum mismatch
    downloaded: h1:WISF656tVHlYe/kd+istlX++s+UbjL5X8f8qKCwl/Ms=
    sum.golang.org: h1:f3aLGJvQmBl8d9S40IL+jEyBC6hfLPbJjv9t5hEM9ck=SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.For more information, see 'go help module-auth'.

Additional Background

go version go1.18.1 darwin/arm64



 Comments   
Comment by Benji Rewis (Inactive) [ 18/May/22 ]

Great! Feel free to open a new ticket or re-open this one if you're still seeing checksum mismatches.

Comment by George King [ 18/May/22 ]

I'm sorry it took so long to get back to you.

I am a developer in China. I use proxies to get expansion packs. There may be a problem at the network layer.

I have upgraded to version 1.9.1. And it is working properly in the project, thank you very much!

Comment by Benji Rewis (Inactive) [ 16/May/22 ]

Ah fascinating. Good to know that getting 1.9.1 does not result in the same error (is it possible for you to use that version?)

I have a feeling this might be a CDN issue... Can I ask where the machine you're running go get from is located? Here in New York, the checksum I get (written next to the go.mongodb.org/mongo-driver dependency in my go.sum) is h1:f3aLGJvQmBl8d9S40IL+jEyBC6hfLPbJjv9t5hEM9ck which appears to be the same as that reported by sum.golang.org. It looks like you're getting h1:WISF656tVHlYe/kd+istlX++s+UbjL5X8f8qKCwl/Ms.

Comment by George King [ 13/May/22 ]

Thanks, I tried running the command `go get go.mongodb.org/mongo-driver@v1.9.1` and it installed the dependencies fine,But run `go get go.mongodb.org/mongo-driver@v1.9.0` still fails!

$ go get go.mongodb.org/mongo-driver@v1.9.1
go: downloading go.mongodb.org/mongo-driver v1.9.1
go: upgraded go.mongodb.org/mongo-driver v1.8.5 => v1.9.1 
 
$ go get go.mongodb.org/mongo-driver@v1.9.0
go: downloading go.mongodb.org/mongo-driver v1.9.0
go: go.mongodb.org/mongo-driver@v1.9.0: verifying module: checksum mismatch
    downloaded: h1:WISF656tVHlYe/kd+istlX++s+UbjL5X8f8qKCwl/Ms=
    sum.golang.org: h1:f3aLGJvQmBl8d9S40IL+jEyBC6hfLPbJjv9t5hEM9ck=SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.For more information, see 'go help module-auth'.$ go clean -modcachego mod tidy
go: downloading go.mongodb.org/mongo-driver v1.9.1
go: downloading github.com/aerogo/aero v1.3.59
go: downloading github.com/aerogo/csp v0.1.10
go: downloading github.com/aerogo/http v1.1.5
go: downloading github.com/aerogo/session v0.1.9
go: downloading github.com/aerogo/session-store-memory v0.1.9
go: downloading github.com/akyoto/color v1.8.12
go: downloading github.com/akyoto/hash v0.5.0
go: downloading github.com/akyoto/stringutils v0.3.1
go: downloading github.com/akyoto/uuid v1.1.3
go: downloading github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/akyoto/colorable v0.1.7
go: downloading github.com/akyoto/tty v0.1.4
go: downloading github.com/go-stack/stack v1.8.0
go: downloading github.com/golang/snappy v0.0.1
go: downloading github.com/klauspost/compress v1.13.6
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f
go: downloading github.com/xdg-go/scram v1.0.2
go: downloading github.com/xdg-go/stringprep v1.0.2
go: downloading golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
go: downloading golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba
go: downloading github.com/klauspost/cpuid/v2 v2.0.12
go: downloading github.com/xdg-go/pbkdf2 v1.0.0
go: downloading golang.org/x/text v0.3.5
go: downloading github.com/akyoto/assert v0.2.4
go: downloading github.com/google/go-cmp v0.5.2
go: downloading github.com/stretchr/testify v1.6.1
go: downloading github.com/tidwall/pretty v1.0.0
go: downloading github.com/zeebo/assert v1.3.0
go: downloading golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543
go: downloading gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c
go: downloading github.com/davecgh/go-spew v1.1.1
go: downloading github.com/pmezard/go-difflib v1.0.0# try go get again!$ go get go.mongodb.org/mongo-driver@v1.9.0
go: downloading go.mongodb.org/mongo-driver v1.9.0
go: go.mongodb.org/mongo-driver@v1.9.0: verifying module: checksum mismatch
    downloaded: h1:WISF656tVHlYe/kd+istlX++s+UbjL5X8f8qKCwl/Ms=
    sum.golang.org: h1:f3aLGJvQmBl8d9S40IL+jEyBC6hfLPbJjv9t5hEM9ck=SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.For more information, see 'go help module-auth'.$ go version
go version go1.18.1 darwin/arm64

Comment by Benji Rewis (Inactive) [ 09/May/22 ]

Thanks for your report, george@betterde.com! We've seen checksum mismatches before (see GODRIVER-1851). As far as I know, there's nothing special about v1.9.0 of the driver that's causing this mismatch in your call to go get.

When you run go get go.mongodb.org/mongo-driver@v1.9.1, do you still see the same issue? And, if you run go clean -modcache and go mod tidy (and possibly go mod vendor if you're vendoring dependencies in your application), and then run go get go.mongodb.org/mongo-driver@v1.9.0, do you still see the same issue?

Generated at Thu Feb 08 08:38:31 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.