Go modules: checksum mismatch

问题

I recently started using modules in Go, but I frequently encounter issues where everything works fine on one machine, but a checksum mismatch is encountered when building the codebase on another machine.

The issue always concerns the same third party dependency (github.com/ericlagergren/decimal):

go: verifying github.com/ericlagergren/decimal@v0.0.0-20181231230500-73749d4874d5: checksum mismatch
    downloaded: h1:HQGCJNlqt1dUs/BhtEKmqWd6LWS+DWYVxi9+Jo4r0jE=
    go.sum:     h1:x4oNpFLLl+8l+iLgksNHzZewTS0SKp6m0hlLwzXRbqA=

I've tried various things: removing & regenerating go.sum, upgrading Go itself to the latest patch version and removing the dependency from go.mod but nothing seems to fix this issue.

Does anyone have an idea how to fix this issue?

回答1:

Which version of Go are you using? There's a good chance you're running into the aftermath of the 1.11.2 -> 1.11.4:

https://github.com/golang/go/issues/27093
https://github.com/golang/go/issues/27925
https://github.com/golang/go/issues/29278

Which still isn't completely resolved. Remember that go mod is still in development, so things like this will probably happen up and until 1.13.

Be sure to read up on minor releases for Go, and how these things can happen: https://github.com/golang/go/wiki/MinorReleases

TL;DR - Upgrade Go

回答2:

You can run go clean -modcache and then go mod tidy which will re-download all deps with the correct checksum (this updates the pkg cache in $GOPATH/pkg/mod/).

To update vendor/ folder run: go mod vendor.

回答3:

I was having the same problem using 1.12.8 and no cache cleaning would help. Turns out I am still locked in the middle of GOPATH and the Mod world. I found a flag in another post (How do I migrate from Dep to Go Modules) that did the trick for me.

go run -mod=vendor main.go

回答4:

I had the same issue. I updated the go version and removed the imports from go.mod and removed all entries from go.sum and ran go mo tidy, which downloaded all the dependencies without any issues.

回答5:

You need to delete your package from the go.sum file. If you run from terminal mode, using CI/CD or Dockerfile you can use that sh command:

sed '/^github.com\/ericlagergren\/decimal@/d' ./go.sum > temp.txt && mv temp.txt go.sum

Which does:

sed - unix application
'/^ - starts line from
github.com\/hyperledger\/fabric v1.4.4 - your package name (actually RegEX line, shield / with \)
/d' - means delete line
go.sum - our golang sum file
> temp.txt - save output to temporary file
mv temp.txt go.sum - rewrite our go.sum with temporary file

P.S.: go mod tidy - only removes unused packages and add new versions. But it doesn`t delete olders.

来源：https://stackoverflow.com/questions/54133789/go-modules-checksum-mismatch

标签

go-modules