tredoe / osutil Goto Github PK

github.com/tredoe/[email protected] requires github.com/tredoe/[email protected]: reading github.com/tredoe/fileutil/go.mod at revision v1.0.0: unknown revision v1.0.0

Did it change recently? My project's travis worked normally yesterday.

When I generate go.sum with go 1.16, and try to build it with go of a different version (1.13 in my case), I get SECURITY ERROR:

verifying github.com/tredoe/[email protected]/go.mod: checksum mismatch
	downloaded: h1:fx79htI3WZA9Ep4jphLFq06l3iRDimfOWTrkKOz+OAA=
	go.sum:     h1:wHEjPMepmXQXkZhf9H4sQcCtmC45KuFo5VR97zG9/dY=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Then I fix (remove the entry and run go mod tidy) go.sum and try to build it again. It works with 1.13, but the problem appears then with 1.16.

Currently, as a workaround, I added this to my build scripts:

sed -i /osutil/d go.sum \
  && go mod download github.com/tredoe/osutil

but it is not a real solution, of course.

I have several hundreds of packages in go.sum, and the problem occurs only with this one, so I suspect there should be some version specific incompatibility in this package (I tested it with Go 1.13 and 1.16 only; not sure exactly when it was introduced, so don't know about 1.14 and 1.15).

Related information/discussions:

• https://groups.google.com/g/golang-nuts/c/a_cHjXkPWYg discussion in go-nuts
• https://stackoverflow.com/questions/68801097/ Question on StackOverflow

This repo is currently tagged with a stable version, however several breaking changes have been introduced since v1.0.5. Should we expect more such changes in the future, or can you commit to following semver, as go modules require?

`go: github.com/tredoe/[email protected]: verifying go.mod: checksum mismatch
downloaded: h1:wHEjPMepmXQXkZhf9H4sQcCtmC45KuFo5VR97zG9/dY=
sum.golang.org: h1:fx79htI3WZA9Ep4jphLFq06l3iRDimfOWTrkKOz+OAA=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.`

I am sorry for creating a new issue for the same problem, but after the recent changes (today? yesterday?) it is not even possible to compile any project that uses tredoe/osutil so all CI jobs are red now.

The problem:

go: github.com/tredoe/[email protected] requires
	github.com/tredoe/[email protected]: reading github.com/tredoe/goutil/go.mod at revision v1.0.2: unknown revision v1.0.2

I wonder where the 1.3.5 version comes from; go.sum references v1.0.6.

Anyway, this is broken now.

We see failing tests for sh module when building under Debian pbuilder environment:

=== RUN   TestRun
--- FAIL: TestRun (0.01s)
	sh_test.go:63: `ls ~/` (match): expected true, found false
	sh_test.go:67: `ls ~/`: output is empty
	sh_test.go:75: `find -name 'sh*.go'` (output): expected "./sh.go\n./sh_test.go\n", found "./sh_test.go\n./sh.go\n"
	sh_test.go:87: `LANG=C find -nop README.md` (error): expected "find: unknown predicate `-nop'", found "find: unknown predicate `-nop'\nTry 'find --help' for more information."
FAIL
FAIL	github.com/tredoe/osutil/sh	0.017s

Our stretch environments have findutils 4.6.0+git+20161106-2 .

Wonder if we're missing some Go env vars while attempting to package?