70 lines
2.7 KiB
Markdown
70 lines
2.7 KiB
Markdown
# PromptKit Bug Report: v0.2.0 Module Checksum Mismatch
|
|
|
|
**Status:** Reproduced by a consumer; cause not yet confirmed.
|
|
|
|
## Summary
|
|
|
|
PromptKit cannot add ReleaseKit v0.2.0 as its module-selected maintainer tool
|
|
with Go's normal checksum verification. The `go.mod` bytes served for the
|
|
version produce a checksum that differs from the checksum database's recorded
|
|
`go.mod` checksum. Go stops with a security error.
|
|
|
|
## PromptKit Context
|
|
|
|
PromptKit is adopting ReleaseKit v0.2.0 as a Go `tool` dependency, following the
|
|
release's documented module-tooling workflow. The version tag currently points
|
|
to commit
|
|
[`e030794969fb7787e647a90bbc4eb81bd0610f07`](https://gitea.maximumdirect.net/eric/ReleaseKit/commit/e030794969fb7787e647a90bbc4eb81bd0610f07).
|
|
The attempt used Go 1.26.8 with `GOTOOLCHAIN=local`.
|
|
|
|
## Reproduction
|
|
|
|
From a Go module, run:
|
|
|
|
```sh
|
|
GOTOOLCHAIN=local go mod download -json gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0
|
|
```
|
|
|
|
Go reports:
|
|
|
|
```text
|
|
verifying gitea.maximumdirect.net/eric/ReleaseKit@v0.2.0/go.mod: checksum mismatch
|
|
downloaded: h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=
|
|
go.sum: h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=
|
|
|
|
SECURITY ERROR
|
|
This download does NOT match an earlier download recorded in go.sum.
|
|
```
|
|
|
|
The conflicting record is visible in the
|
|
[Go checksum database lookup](https://sum.golang.org/lookup/gitea.maximumdirect.net/eric/!release!kit@v0.2.0).
|
|
It records `h1:xN8w1OWjhCwtDxyHVFbKxFWowuEPbMTCZrf0JIIm9pE=` for the module's
|
|
`go.mod`. A diagnostic fetch with `GOSUMDB=off` reports the same v0.2.0 tag
|
|
commit above, archive checksum
|
|
`h1:EACELngRel4RiulR+Ors56nMZ5fA9orJDyhPxn6UVe4=`, and `go.mod` checksum
|
|
`h1:KmH607Vc/RK/zKrCB96cWh0QZYvkbxBFvtqV+BkKaxs=`. Disabling the checksum
|
|
database was used only to inspect the fetched source; it is not a proposed
|
|
consumer workaround.
|
|
|
|
## Expected Behavior
|
|
|
|
The published v0.2.0 module metadata and the checksum database record should
|
|
agree, so Go can verify and download the release normally.
|
|
|
|
## Consumer Impact
|
|
|
|
PromptKit's dependency preparation stops before it can reliably select
|
|
ReleaseKit v0.2.0 as a tool. Go's warning prevents proceeding with the normal
|
|
integrity check. This does not affect PromptKit's runtime API or behavior; the
|
|
tool dependency is for maintainer workflows.
|
|
|
|
## Investigation Requested
|
|
|
|
Please compare the `v0.2.0` tag's `go.mod`, the module proxy's `.mod` response,
|
|
and the checksum database record to determine why their checksums differ. The
|
|
available evidence confirms the mismatch but does not establish whether the
|
|
tagged metadata changed after checksum publication, the proxy is serving
|
|
different metadata, or the checksum record is otherwise inconsistent. Please
|
|
advise on a verified immutable version consumers can select once the cause is
|
|
known.
|