CODEWITHSUNDEEP
gogo-modules
edwardmp
edwardmp

Reputation: 6601

Go modules: checksum mismatch

I recently started using modules in Go, but I frequently encounter issues where everything works fine on one machine, but a checksum mismatch is encountered when building the codebase on another machine.

The issue always concerns the same third party dependency (github.com/ericlagergren/decimal):

go: verifying github.com/ericlagergren/[email protected]: checksum mismatch
    downloaded: h1:HQGCJNlqt1dUs/BhtEKmqWd6LWS+DWYVxi9+Jo4r0jE=
    go.sum:     h1:x4oNpFLLl+8l+iLgksNHzZewTS0SKp6m0hlLwzXRbqA=

I've tried various things: removing & regenerating go.sum, upgrading Go itself to the latest patch version and removing the dependency from go.mod but nothing seems to fix this issue.

Does anyone have an idea how to fix this issue?

Upvotes: 46

Views: 73061

Answers (10)

Alex Efimov
Alex Efimov

Reputation: 3703

You can run go clean -modcache, delete go.sum and then go mod tidy which will re-download all deps with the correct checksum (this updates the pkg cache in $GOPATH/pkg/mod/).

To update vendor/ folder run: go mod vendor.

Upvotes: 75

Ivan Ruski
Ivan Ruski

Reputation: 1270

In my case, my teammate committed a different sum in the go.sum for the problematic package and all I had to do was to revert the go.sum to its previous state.

Which made a lot of sense in my case because the package I was having problems with hadn't been changed for years.

Upvotes: 1

Maxime Libs
Maxime Libs

Reputation: 11

you can also check / set the GOPROXY to prevent such cases when updating
go env GOPROXY
go env -w GOPROXY=https://proxy.golang.org,direct

this with go clean -modcache and go mod tidy should fix the issue

EDIT: source

Upvotes: 1

stonecutter
stonecutter

Reputation: 77

I encountered this problem because of the GOPROXY, and the problem was solved by changing the proxy address.

Upvotes: 2

wow qing
wow qing

Reputation: 442

you can try like this:

$ go get sigs.k8s.io/[email protected]
go: downloading sigs.k8s.io/controller-runtime v0.14.1
verifying sigs.k8s.io/[email protected]/go.mod: checksum mismatch
        downloaded: h1:GaRkrY8a7UZF0kqFFbUKG7n9ICiTY5T55P1RiE3UZlU=
        go.sum:     h1:G7mAYYxgmS0lVkHyy2hEOLQCFB0DlQFTMLWggykrydY=

remove the relate file on the mod cache

# rm -rf ~/go/pkg/mod/sigs.k8s.io/[email protected]/
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.zip
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.info
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.mod
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.lock
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.ziphash

Upvotes: 1

chandan singh
chandan singh

Reputation: 349

  1. remove go.sum : rm go.sum
  2. regenerate go.sum : go mod tidy

Upvotes: 28

Vladimir
Vladimir

Reputation: 461

You need to delete your package from the go.sum file. If you run from terminal mode, using CI/CD or Dockerfile you can use that sh command:

sed '/^github.com\/ericlagergren\/decimal@/d' ./go.sum > temp.txt && mv temp.txt go.sum

Which does:

  • sed - unix application
  • '/^ - starts line from
  • github.com\/hyperledger\/fabric v1.4.4 - your package name (actually RegEX line, shield / with \)
  • /d' - means delete line
  • go.sum - our golang sum file
  • > temp.txt - save output to temporary file
  • mv temp.txt go.sum - rewrite our go.sum with temporary file

P.S.: go mod tidy - only removes unused packages and add new versions. But it doesn`t delete olders.

Upvotes: 1

randeepsp
randeepsp

Reputation: 3842

I had the same issue. I updated the go version and removed the imports from go.mod and removed all entries from go.sum and ran go mo tidy, which downloaded all the dependencies without any issues.

Upvotes: 1

beauXjames
beauXjames

Reputation: 8418

I was having the same problem using 1.12.8 and no cache cleaning would help. Turns out I am still locked in the middle of GOPATH and the Mod world. I found a flag in another post (How do I migrate from Dep to Go Modules) that did the trick for me.

go run -mod=vendor main.go

Upvotes: 1

syntaqx
syntaqx

Reputation: 2866

Which version of Go are you using? There's a good chance you're running into the aftermath of the 1.11.2 -> 1.11.4:

Which still isn't completely resolved. Remember that go mod is still in development, so things like this will probably happen up and until 1.13.

Be sure to read up on minor releases for Go, and how these things can happen: https://github.com/golang/go/wiki/MinorReleases

TL;DR - Upgrade Go

Upvotes: 13

Related Questions