PromptKit Bug Report: v0.2.0 Module Checksum Mismatch

Status: Reproduced by a consumer; cause not yet confirmed.

Summary

PromptKit cannot add ReleaseKit v0.2.0 as its module-selected maintainer tool with Go's normal checksum verification. The go.mod bytes served for the version produce a checksum that differs from the checksum database's recorded go.mod checksum. Go stops with a security error.

PromptKit Context

PromptKit is adopting ReleaseKit v0.2.0 as a Go tool dependency, following the release's documented module-tooling workflow. The version tag currently points to commit e030794969fb7787e647a90bbc4eb81bd0610f07. The attempt used Go 1.26.8 with GOTOOLCHAIN=local.

Reproduction

From a Go module, run:

GOTOOLCHAIN=local go mod download -json gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0

Go reports:

verifying gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0/go.mod: checksum mismatch
	downloaded: h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=
	go.sum:     h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.

The conflicting record is visible in the Go checksum database lookup. It records h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE= for the module's go.mod. A diagnostic fetch with GOSUMDB=off reports the same v0.2.0 tag commit above, archive checksum h1:EACELngRel4RiulR+Ors56nMZ5fA9orJDyhPxn6UVe4=, and go.mod checksum h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=. Disabling the checksum database was used only to inspect the fetched source; it is not a proposed consumer workaround.

Expected Behavior

The published v0.2.0 module metadata and the checksum database record should agree, so Go can verify and download the release normally.

Consumer Impact

PromptKit's dependency preparation stops before it can reliably select ReleaseKit v0.2.0 as a tool. Go's warning prevents proceeding with the normal integrity check. This does not affect PromptKit's runtime API or behavior; the tool dependency is for maintainer workflows.

Investigation Requested

Please compare the v0.2.0 tag's go.mod, the module proxy's .mod response, and the checksum database record to determine why their checksums differ. The available evidence confirms the mismatch but does not establish whether the tagged metadata changed after checksum publication, the proxy is serving different metadata, or the checksum record is otherwise inconsistent. Please advise on a verified immutable version consumers can select once the cause is known.

2.7 KiB Raw Blame History