Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Latest version 1.1.3 needs a go mod tidy #632

Closed
tartale opened this issue Feb 10, 2022 · 1 comment · Fixed by #633
Closed

Latest version 1.1.3 needs a go mod tidy #632

tartale opened this issue Feb 10, 2022 · 1 comment · Fixed by #633

Comments

@tartale
Copy link
Contributor

tartale commented Feb 10, 2022

Describe the bug
My run of dependabot tripped on the version 1.1.3 of this repo:

verifying github.com/mgechev/revive@v1.1.3/go.mod: checksum mismatch

I cloned the repo, and found that running go mod tidy updated the go.sum file; perhaps an oversight on the latest release. I won't know if this fixes the issue I'm seeing on dependabot until it's merged and a new version is tagged.

To Reproduce
Steps to reproduce the behavior:

  1. I updated revive go get -u github.com/mgechev/revive
  2. I ran dependabot on my own repo

Expected behavior
dependabot ought to be able to download this dependency, and the checksum matches.

Logs
N/A

Desktop (please complete the following information):

  • OS: macOS Catalina
  • Version of Go: 1.17

Additional context
N/A

@Zenithar
Copy link

Zenithar commented Feb 11, 2022

👋 - @mgechev - Did you inadvertently overwrite the tag? Because this dependency is referenced by golangci since version 1.44.0 (published 17 days ago) and looks to be published yesterday.

golangci/golangci-lint@620bd9b
This will raise the GOSUMDB error

 #24 61.27 verifying github.com/mgechev/revive@v1.1.3: checksum mismatch
#24 61.27 	downloaded: h1:ArABBj0sr7jnQnIvBM2NlH8kcv4LaiaAStCAKMSfslk=
#24 61.27 	go.sum:     h1:6tBZacs2/uv9UOpkBQhCtXh2NGgu2Ry97ZyjcN6uDCM=
#24 61.27 
#24 61.27 SECURITY ERROR
#24 61.27 This download does NOT match an earlier download recorded in go.sum.
#24 61.27 The bits may have been replaced on the origin server, or an attacker may
#24 61.27 have intercepted the download attempt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants