英文:
go mod checksum mismatch
问题
到目前为止，我是团队中唯一能够复现以下软件包问题的开发人员。
为了纠正这个不匹配，我尝试了以下方法：
- 运行
go clean -modcache - 删除
.mod和.sum文件中的相关条目 - 完全删除
.mod和.sum文件 - 完全删除供应商目录
- 卸载 golang 并清除机器上的所有 go 相关内容
- 重新安装最新版本的 go
> go get go.temporal.io/sdk@v1.10.0
go: 正在下载 go.temporal.io/sdk v1.10.0
go get: go.temporal.io/sdk@v1.10.0: 验证模块: 校验和不匹配
已下载: h1:t0t/mtBxetBZUhvLB2mE2g7lgZcJDRAf1OPkV63+CfM=
sum.golang.org: h1:JfzXWB+/EcDcC6poz6/k0dc57qas+Es1LMcIXEvP8IA=
我可以正常安装其他版本，只有 v1.10.0 无法安装。有人对如何解决这个问题有任何建议或想法吗？
编辑：
作为一种解决方法，我将这个软件包添加到了 GOPRIVATE 中，这将排除它的校验和不匹配。
export GOPRIVATE="go.temporal.io"
英文:
Thus far I'm the only developer on my team that can replicate this issue for the below package.
To correct the mismatch I've tried:
- go clean -modcache
- removing related entries in
.mod.sumfiles - entirely removing
.modand.sumfiles - entirely removed the vendor directly
- uninstalling golang and purging all things go on my machine
- reinstalling latest version of go
> go get go.temporal.io/sdk@v1.10.0
go: downloading go.temporal.io/sdk v1.10.0
go get: go.temporal.io/sdk@v1.10.0: verifying module: checksum mismatch
downloaded: h1:t0t/mtBxetBZUhvLB2mE2g7lgZcJDRAf1OPkV63+CfM=
sum.golang.org: h1:JfzXWB+/EcDcC6poz6/k0dc57qas+Es1LMcIXEvP8IA=
I can install other versions just fine, just not v1.10.0. Does anyone have any suggestions or ideas on how to fix this?
EDIT:
As a work around I've added this package to GOPRIVATE which will exclude it from the checksum mismatch.
export GOPRIVATE="go.temporal.io"
答案1
得分: 3
通常情况下，当模块的维护者尝试将现有的标签从一个提交移动到另一个提交时，会出现这种情况。这是不允许的：Go checksum database 在第一次遇到新模块版本时会存储一个永久且不可撤销的校验和，该校验和用于验证该模块在之前的下载中是否被篡改。
如果某个特定版本存在严重问题，可以撤回该版本并发布一个新的补丁。然而，新的补丁必须具有自己的唯一版本（通常是在原版本的基础上将补丁号增加一）。
在这种情况下，正确的解决方法是放弃 v1.10.0，并让上游标记一个新的发布版本。
英文:
Generally this occurs when the maintainer of the module attempts to move an existing tag from one commit to another. That isn't allowed: the Go checksum database stores a permanent, irrevocable checksum the first time it encounters a new module version, and that checksum is used to verify that the module hasn't been tampered with for previous downloads.
If there is a severe problem with a given release, that release can be retracted and a new patch issued. However, the new patch must have its own unique version (generally the same version with the patch number increased by one).
The proper fix here is to abandon v1.10.0 and get the upstream to tag a new release.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论