I am trying to update an imported library published internally from my company. it works locally but when I push up to my CI machine I continuously get this error:
verifying organization.team/repo@v0.0.0-20211002191200-123ab4567890: checksum mismatch
downloaded: h1:AC4Y8O95qWQoRDUIkeOOE03FOgyJYhZ2hR+3CDSn/Ngc=
go.sum: h1:j8IOQKqRRU/+IO9395vywb-JD0VesRqymC4h6PIkIKDO2A=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
In this example organization.team/repo is a library originating from a Git repo in the same company account. My go.mod looks something like this:
module mypackage
go 1.15
require (
organization.team/repo 0.0.0-20211002191200-123ab4567890
...etc...
}
Where the only change I've made is from the old version, basically I changed the go mod to have a newer version of the imported library, e.g:
instead of
organization.team/repo 0.0.0-20211002191200-123ab4567890
I had
organization.team/repo 0.0.0-20210901131200-456cd7892890
I'm not sure what to check at this point. I tried running a go mod tidy, as well as a go clean -modcache which other users seem to have had success with in a similar issue - and then a go mod tidy - and always the same issue. The checksum I get when I calculate it locally is always different than what the worker on the CI machine runs.
I've also tried running those commands and forcing it to the version of Go that the CI machines are on (1.15) by running go1.15.15 mod tidy and go1.15.15 clean -modcache, but my checksum remains the same whether I am locally using Go 1.15 or 1.16.
As others have pointed out in similar threads - git lfs is not at work here either, I don't have that installed. And when I did install it - same issue.
What makes it more confusing, is if I'm in the same pull request, I can upgrade the version of my organization.team/repo, get this error, and then I've tried actually downgrading back to the last working version, and the issue still persists.
Would appreciate some suggestions - I'm not even clear on what could possibly be going on.