hashicorp/go-rootcerts

Checksum mismatch, again

rustatian opened this issue · 9 comments

rustatian commented

Working on the latest linux/mac distributions, but not working on the ubuntu server 14.04 (uname -romi: 3.13.0-164-generic x86_64 x86_64 GNU/Linux)

go: verifying github.com/hashicorp/go-rootcerts@v1.0.0: checksum mismatch
downloaded: h1:ueI78wUjYExhCvMLow4icJnayNNFRgy0d9EGs/a1T44=
go.sum: h1:Rqb66Oo1X/eSV1x66xbDccZjhJigjg0+e82kpwzSwCI=
jefferai commented

What version of Go?

rustatian commented

What version of Go?

Tested on: 1.12, 1.11.5

jefferai commented

Please try go clean -modcache

rustatian commented

Please try go clean -modcache

The issue is still present

2tvenom commented

same

jefferai commented

I really don't know what the issue is as I can't reproduce.

I copied and pasted the example into a new package main.go:

package main

import (
        "crypto/tls"
        "os"

        "github.com/hashicorp/go-cleanhttp"
        "github.com/hashicorp/go-rootcerts"
)

func main() {
        tlsConfig := &tls.Config{}
        err := rootcerts.ConfigureTLS(tlsConfig, &rootcerts.Config{
                CAFile: os.Getenv("MYAPP_CAFILE"),
                CAPath: os.Getenv("MYAPP_CAPATH"),
        })
        if err != nil {
                return
        }
        c := cleanhttp.DefaultClient()
        t := cleanhttp.DefaultTransport()
        t.TLSClientConfig = tlsConfig
        c.Transport = t
        return
}

And as you can see there is no error. You can also see that the version I see is the one that matches go.sum:

$ go mod init github.com/jefferai/rootcertstest
go: creating new go.mod: module github.com/jefferai/rootcertstest

$ go build .

$ ls
go.mod  go.sum  main.go  rootcertstest

$ cat go.sum 
github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
github.com/hashicorp/go-rootcerts v1.0.0 h1:Rqb66Oo1X/eSV1x66xbDccZjhJigjg0+e82kpwzSwCI=
github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=

Are you running in your gopath? If so I wonder if there is something stale in there causing an issue, and you may want to try from outside your gopath.

jefferai commented

Note I'm on Ubuntu 18.04 in the above test. If you are only seeing this on very old versions of Ubuntu and can come up with a similarly repeatable test case I would suggest filing a ticket with Go.

rustatian commented

Note I'm on Ubuntu 18.04 in the above test. If you are only seeing this on very old versions of Ubuntu and can come up with a similarly repeatable test case I would suggest filing a ticket with Go.

This issue appears on 14.04 version of Ubuntu server. When you're creating the go.mod file in a newer version of any Linux (I am using Arch for example) and then copying the package to the server and run go mod download on it. Other dependencies work well. To reproduce, please, try to create the package you mentioned before and put it with go.mod and go.sum files (with hashes, calculated on 18.04) to the virtual machine with a fresh version of Ubuntu server 14.04 and run go mod download on it. Thanks.

jefferai commented

Unfortunately I need to leave that to you -- if it's only reproducible on very old distributions, this is almost certainly a Go bug on that platform, not a problem with this package. (And 14.04 is EOL'd in one month, to boot.)

I suggest filing a ticket with the Go team at https://github.com/golang/go