go data_error ai_generated partial

verifying github.com/foo/[email protected]: checksum mismatch: downloaded hash (h1:abc123) != expected hash (h1:def456)

ID: go/checksum-mismatch-download

Also available as: JSON · Markdown · 中文
80%Fix Rate
80%Confidence
0Evidence
2024-02-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.11 active — — —
1.17 active — — —
1.22 active — — —

Root Cause

The downloaded module content does not match the checksum recorded in go.sum, possibly due to a corrupted download or a malicious proxy.

generic

中文

下载的模块内容与 go.sum 中记录的校验和不匹配，可能是下载损坏或代理被篡改。

Workarounds

  1. 70% success 
    go mod download github.com/foo/[email protected] && go mod tidy
  2. 40% success 
    GONOSUMDB=github.com/foo/bar go mod download

Dead Ends

Common approaches that don't work:

  1. 50% fail

    If the proxy is serving corrupted data, re-downloading will produce the same mismatch.

  2. 60% fail

    Go will still verify checksums unless you use GONOSUMCHECK (deprecated) or GONOSUMDB; this may hide security issues.