eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Report PromptKit's v0.2.0 checksum mismatch

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-08 14:15:00 +00:00
parent e030794969
commit c339872bfe
1 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
docs/roadmap/promptkit-bug-report.md Normal file
View File

@@ -0,0 +1,69 @@
# PromptKit Bug Report: v0.2.0 Module Checksum Mismatch
**Status:** Reproduced by a consumer; cause not yet confirmed.
## Summary
PromptKit cannot add ReleaseKit v0.2.0 as its module-selected maintainer tool
with Go's normal checksum verification. The `go.mod` bytes served for the
version produce a checksum that differs from the checksum database's recorded
`go.mod` checksum. Go stops with a security error.
## PromptKit Context
PromptKit is adopting ReleaseKit v0.2.0 as a Go `tool` dependency, following the
release's documented module-tooling workflow. The version tag currently points
to commit
[`e030794969fb7787e647a90bbc4eb81bd0610f07`](https://gitea.maximumdirect.net/eric/ReleaseKit/commit/e030794969fb7787e647a90bbc4eb81bd0610f07).
The attempt used Go 1.26.8 with `GOTOOLCHAIN=local`.
## Reproduction
From a Go module, run:
```sh
GOTOOLCHAIN=local go mod download -json gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0
```
Go reports:
```text
verifying gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0/go.mod: checksum mismatch
downloaded: h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=
go.sum: h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
```
The conflicting record is visible in the
[Go checksum database lookup](https://sum.golang.org/lookup/gitea.maximumdirect.net/eric/!release!kit@v0.2.0).
It records `h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=` for the module's
`go.mod`. A diagnostic fetch with `GOSUMDB=off` reports the same v0.2.0 tag
commit above, archive checksum
`h1:EACELngRel4RiulR+Ors56nMZ5fA9orJDyhPxn6UVe4=`, and `go.mod` checksum
`h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=`. Disabling the checksum
database was used only to inspect the fetched source; it is not a proposed
consumer workaround.
## Expected Behavior
The published v0.2.0 module metadata and the checksum database record should
agree, so Go can verify and download the release normally.
## Consumer Impact
PromptKit's dependency preparation stops before it can reliably select
ReleaseKit v0.2.0 as a tool. Go's warning prevents proceeding with the normal
integrity check. This does not affect PromptKit's runtime API or behavior; the
tool dependency is for maintainer workflows.
## Investigation Requested
Please compare the `v0.2.0` tag's `go.mod`, the module proxy's `.mod` response,
and the checksum database record to determine why their checksums differ. The
available evidence confirms the mismatch but does not establish whether the
tagged metadata changed after checksum publication, the proxy is serving
different metadata, or the checksum record is otherwise inconsistent. Please
advise on a verified immutable version consumers can select once the cause is
known.