Github actions checksum mismatch

[khems]

Hi, I'm having trouble with this package giving me a checksum mismatch when deploying on github actions. I'm not getting this problem locally. I've tried re-installing dependencies etc. and I get the same checksum locally each time. I've tried using different versions of go (1.16 and 1.22).

I've tried sam build on an x86_64 mac and an arm64 mac and github actions is the anomaly.

Before using this package I haven't had this issue - it was deploying fine. This is why I am posting here.

Run sam build
  
Starting Build use cache
Starting Build inside a container
Cache is invalid, running build and copying resources for following functions (DocumentSigningFunctionBeta)
Building codeuri: /home/runner/work/document-signing/document-signing/document-signing runtime: provided.al2023 metadata: {'BuildMethod': 'makefile'} architecture: x86_64 functions: DocumentSigningFunctionBeta
Fetching public.ecr.aws/sam/build-provided.al2023:latest-x86_64 Docker container image....................................................................................................................................................................................................................................................................................................................................................
Mounting /home/runner/work/document-signing/document-signing/document-signing as /tmp/samcli/source:ro,delegated, inside runtime container
Build Failed
DocumentSigningFunctionBeta: Running CustomMakeBuilder:CopySource
DocumentSigningFunctionBeta: Running CustomMakeBuilder:MakeBuild
DocumentSigningFunctionBeta: Current Artifacts Directory : /tmp/samcli/artifacts
GOOS=linux go build -o bootstrap
go: downloading github.com/aws/aws-lambda-go v1.46.0
go: downloading github.com/aws/aws-sdk-go v1.51.8
go: downloading github.com/julienschmidt/httprouter v1.3.0
go: downloading github.com/pdfcpu/pdfcpu v0.7.0
go: downloading github.com/jmespath/go-jmespath v0.4.0
verifying github.com/pdfcpu/pdfcpu@v0.7.0: checksum mismatch
	downloaded: h1:Xt/WnS0A77V5b91NIJ5NdCvmCHSmoNaX/aaosHzQNwg=
	go.sum:     h1:cd7/z7hAyyDuzdciKfNZyQ3TYreJza2DsuPdIHYURcA=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
For more information, see 'go help module-auth'.
make: *** [/tmp/samcli/source/Makefile:4: build-DocumentSigningFunctionBeta] Error 1
Error: Process completed with exit code 1.

Thank you for submitting a possible bug!

Please ensure the following:

• Your issue is based on the latest commit

• State your OS and OS version
  public.ecr.aws/sam/build-provided.al2023:latest-x86_64

• When reporting a problem with a specific PDF input file please avoid stating the organization responsible for the PDFWriter - just refer to the PDFWriter

[khems]

Now when I try go mod tidy on my local machine it's giving a similar error

	github.com/pdfcpu/pdfcpu/pkg/api: github.com/pdfcpu/pdfcpu@v0.7.0: verifying module: checksum mismatch
	downloaded: h1:Xt/WnS0A77V5b91NIJ5NdCvmCHSmoNaX/aaosHzQNwg=
	sum.golang.org: h1:cd7/z7hAyyDuzdciKfNZyQ3TYreJza2DsuPdIHYURcA=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

[khems]

0.6.0 works fine - only getting the problem with 0.7.0

[dcrystalj]

I have same issue

[hhrutter]

Have you tried removing your local pdfcpu clone and restart from scratch?

[khems]

Yes

[hhrutter]

Did you execute go clean -modcache before go mod tidy?
If this does not work for you get the latest commit instead of the latest release.
-> https://go.dev/wiki/Modules#how-to-upgrade-and-downgrade-dependencies

[khems]

Yes

[go-dockly]

same issue here. Could you please rebuild 0.7

[hhrutter]

Folks!
A new release is in preparation.
Until then please use the latest commit.

[hhrutter]

This should not be an issue anymore -> https://github.com/pdfcpu/pdfcpu/releases/tag/v0.8.0