Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

xcaddy mentions a version of a module that doesn't exist? #64

Closed
polarathene opened this issue Aug 18, 2021 · 2 comments
Closed

xcaddy mentions a version of a module that doesn't exist? #64

polarathene opened this issue Aug 18, 2021 · 2 comments

Comments

@polarathene
Copy link

polarathene commented Aug 18, 2021

UPDATE: Resolved. I don't know the cause of the version bumping behaviour but assume it's unrelated to Caddy and to do with Go get functionality.

I was able to get a successful build of the module by overriding problematic dependencies versions with newer ones or referencing git commits (not mentioned on xcaddy README as possible). That should probably be added to the README for troubleshooting :)


Recently the Souin Caddy plugin was updated and was meant to fix a verifying module: checksum mismatch error, but when I attempted to build that module again (without a version in --with) I got the same build failure.

No new tagged release was made on the project, I tried building the older tagged commit, but it failed as expected.

It's not documented in this projects README, but prior issues have mentioned referencing a specific commit instead, so I tried that:

ARG CADDY_VERSION=2.4.3
FROM caddy:${CADDY_VERSION}-builder AS builder
ARG SOUIN_VERSION=@ed8b9e9fd2d4

RUN xcaddy build \
    --with github.com/darkweak/souin/plugins/caddy${SOUIN_VERSION}

FROM caddy:${CADDY_VERSION}-alpine

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

This fails with the same error and checksum mismatch values, presumably because the plugins go.mod continues to reference the darkweak/souin@v1.5.2 dependency that triggered the mismatch errors experienced?

go get: added github.com/caddyserver/caddy/v2 v2.4.3                                                                                                                                                                        
2021/08/17 23:40:45 [INFO] exec (timeout=0s): /usr/local/go/bin/go get -d -v github.com/darkweak/souin/plugins/caddy@ed8b9e9fd2d46fd1db317b72ccc1fdaa811abf03                                                               
go: downloading github.com/darkweak/souin/plugins/caddy v0.0.0-20210817165413-ed8b9e9fd2d4                                                                                                                                  
go: downloading github.com/darkweak/souin v1.5.3-0.20210817165413-ed8b9e9fd2d4                                                                                                                                              
go: downloading github.com/darkweak/souin v1.5.2                                                                                                                                                                            
github.com/darkweak/souin/plugins/caddy: github.com/darkweak/souin@v1.5.2: verifying module: checksum mismatch                                                                                                              
    downloaded: h1:7Hm4N7WS7GDk4KANPg3LGk0m2AGfIrIX1DHkytWVATw=
    sum.golang.org: h1:WS/Q+qq7c+dIIw/abYYtWMpfj1ucjhfvaabW5Q+K6tc=

SECURITY ERROR                                                                                                                                                                                                              
This download does NOT match the one reported by the checksum server.                                                                                                                                                       
The bits may have been replaced on the origin server, or an attacker may                                                                                                                                                    
have intercepted the download attempt. 

The odd Caddy versioning I have seen and I assume is related to this reason (and nothing to do with xcaddy but how Go get works?), but why is the souin package mentioned twice, once with the non-existent (atm) v1.5.3-* tag, then the existing v1.5.2 tag (specified in the go.mod):

go: downloading github.com/darkweak/souin/plugins/caddy v0.0.0-20210817165413-ed8b9e9fd2d4                                                                                                                                  
go: downloading github.com/darkweak/souin v1.5.3-0.20210817165413-ed8b9e9fd2d4      

Is this something Go get is doing "bumping" a fake version because I provided a git commit hash after the commit of the latest tagged release? It then overrides that with the pinned version in go.mod causing the mismatch?

Or is this an issue on the maintainers end that they can fix? (related issue on their repo)

@polarathene
Copy link
Author

Just for clarity, here is the output for --with pinning to @v1.5.2:

go get: added github.com/caddyserver/caddy/v2 v2.4.3                                                                                                                                                                        
2021/08/17 23:34:38 [INFO] exec (timeout=0s): /usr/local/go/bin/go get -d -v github.com/darkweak/souin/plugins/caddy@v1.5.2                                                                                                 
go: downloading github.com/darkweak/souin v1.5.2                                                                                                                                                                            
go get github.com/darkweak/souin/plugins/caddy@v1.5.2: github.com/darkweak/souin@v1.5.2: verifying module: checksum mismatch 
    downloaded: h1:7Hm4N7WS7GDk4KANPg3LGk0m2AGfIrIX1DHkytWVATw=
    sum.golang.org: h1:WS/Q+qq7c+dIIw/abYYtWMpfj1ucjhfvaabW5Q+K6tc=

And without any specific tag/commit:

go get: added github.com/caddyserver/caddy/v2 v2.4.3                                                                                                                                                                        
2021/08/17 23:23:22 [INFO] exec (timeout=0s): /usr/local/go/bin/go get -d -v github.com/darkweak/souin/plugins/caddy                                                                                                        
go: downloading github.com/darkweak/souin/plugins/caddy v0.0.0-20210817165413-ed8b9e9fd2d4                                                                                                                                  
go: downloading github.com/darkweak/souin v1.5.2                                                                                                                                                                            
github.com/darkweak/souin/plugins/caddy: github.com/darkweak/souin@v1.5.2: verifying module: checksum mismatch 
    downloaded: h1:7Hm4N7WS7GDk4KANPg3LGk0m2AGfIrIX1DHkytWVATw=
    sum.golang.org: h1:WS/Q+qq7c+dIIw/abYYtWMpfj1ucjhfvaabW5Q+K6tc=

@polarathene
Copy link
Author

polarathene commented Aug 18, 2021

I figured out a way to address the issue and progress the build further. I did not realize I could override the dependency version with --with lines to xcaddy. It might help to add that as a troubleshooting / workaround tip?

ARG CADDY_VERSION=2.4.3
FROM caddy:${CADDY_VERSION}-builder AS builder
ARG SOUIN_VERSION=@ed8b9e9fd2d4

RUN xcaddy build \
    --with github.com/darkweak/souin${SOUIN_VERSION} \
    --with github.com/darkweak/souin/plugins/caddy${SOUIN_VERSION}

FROM caddy:${CADDY_VERSION}-alpine

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

This still fails, but appears to be an issue for the maintainer of the module to look into and resolve, or possibly another module I can override as the error looks like it's referencing an rc version of a dependency for some reason..


EDIT: I was able to resolve that issue too in the same manner. For some reason the plugin has a go.sum file with all 3 major versions of the package (Badger), I think it only uses the latest major version and this is a issue with housekeeping of such a file (not familiar with Go dev, in Rust and NodeJS there's no need to commit a vendor dir of packages/dependencies, which on their project creates rather noisy diffs in their PRs).

In this case, I had to override the 2nd major version release with the latest v2, doing so for any other version had no effect as they're presumably distinct (not sure how that works with imports, or if these older versions are even used and throwing build errors for unused dependencies).

ARG CADDY_VERSION=2.4.3
FROM caddy:${CADDY_VERSION}-builder AS builder
ARG SOUIN_VERSION=@ed8b9e9fd2d4

RUN xcaddy build \
    --with github.com/darkweak/souin${SOUIN_VERSION} \
    --with github.com/dgraph-io/badger/v2 \
    --with github.com/darkweak/souin/plugins/caddy${SOUIN_VERSION}

FROM caddy:${CADDY_VERSION}-alpine

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant