Go modules: checksum mismatch

I recently started using modules in Go, but I frequently encounter issues where everything works fine on one machine, but a checksum mismatch is encountered when building the codebase on another machine.

The issue always concerns the same third party dependency (github.com/ericlagergren/decimal):

go: verifying github.com/ericlagergren/decimal@v0.0.0-20181231230500-73749d4874d5: checksum mismatch
	downloaded: h1:HQGCJNlqt1dUs/BhtEKmqWd6LWS+DWYVxi9+Jo4r0jE=
	go.sum:     h1:x4oNpFLLl+8l+iLgksNHzZewTS0SKp6m0hlLwzXRbqA=

I've tried various things: removing & regenerating go.sum, upgrading Go itself to the latest patch version and removing the dependency from go.mod but nothing seems to fix this issue.

Does anyone have an idea how to fix this issue?

You can run go clean -modcache and then go mod tidy which will re-download all deps with the correct checksum (this updates the pkg cache in $GOPATH/pkg/mod/).

To update vendor/ folder run: go mod vendor.

1. remove go.sum : rm go.sum
2. regenerate go.sum : go mod tidy

Which version of Go are you using? There's a good chance you're running into the aftermath of the 1.11.2 -> 1.11.4:

• https://github.com/golang/go/issues/27093
• https://github.com/golang/go/issues/27925
• https://github.com/golang/go/issues/29278

Which still isn't completely resolved. Remember that go mod is still in development, so things like this will probably happen up and until 1.13.

Be sure to read up on minor releases for Go, and how these things can happen: https://github.com/golang/go/wiki/MinorReleases

> TL;DR - Upgrade Go

I encountered this problem because of the GOPROXY, and the problem was solved by changing the proxy address.

I was having the same problem using 1.12.8 and no cache cleaning would help. Turns out I am still locked in the middle of GOPATH and the Mod world. I found a flag in another post (https://stackoverflow.com/questions/55664630/how-do-i-migrate-from-dep-to-go-modules) that did the trick for me.

go run -mod=vendor main.go

I had the same issue. I updated the go version and removed the imports from go.mod and removed all entries from go.sum and ran go mo tidy, which downloaded all the dependencies without any issues.

You need to delete your package from the go.sum file.
If you run from terminal mode, using CI/CD or Dockerfile you can use that sh command:

sed '/^github.com\/ericlagergren\/decimal@/d' ./go.sum > temp.txt && mv temp.txt go.sum

Which does:

• sed - unix application
• '/^ - starts line from
• github.com\/hyperledger\/fabric v1.4.4 - your package name (actually RegEX line, shield / with \)
• /d' - means delete line
• go.sum - our golang sum file
• > temp.txt - save output to temporary file
• mv temp.txt go.sum - rewrite our go.sum with temporary file

P.S.: go mod tidy - only removes unused packages and add new versions. But it doesn`t delete olders.

you can try like this:

$ go get sigs.k8s.io/controller-runtime@v0.14.1
go: downloading sigs.k8s.io/controller-runtime v0.14.1
verifying sigs.k8s.io/controller-runtime@v0.14.1/go.mod: checksum mismatch
        downloaded: h1:GaRkrY8a7UZF0kqFFbUKG7n9ICiTY5T55P1RiE3UZlU=
        go.sum:     h1:G7mAYYxgmS0lVkHyy2hEOLQCFB0DlQFTMLWggykrydY=

remove the relate file on the mod cache

# rm -rf ~/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.1/
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.zip
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.info
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.mod
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.lock
# rm ~/go/pkg/mod/cache/download/sigs.k8s.io/controller-runtime/@v/v0.14.1.ziphash