Can't install Go SDK (module checksum mismatch)

[arjanvaneersel]

Subject of the issue

Can't install Go SDK

Your environment

Steps to reproduce

1. go get -u github.com/algorand/go-algorand-sdk/...

Expected behaviour

Successful installation

Actual behaviour

go: downloading github.com/algorand/go-algorand-sdk v1.12.0
go get github.com/algorand/go-algorand-sdk/...: github.com/algorand/[email protected]: verifying module: checksum mismatch
	downloaded: h1:u2H9uhmQR+00P8sgaRJxTqmyJU52lKcPoCVRmMJCLu0=
	sum.golang.org: h1:j3+Jdnek/EnvxMoiBw9o3OtkDf3R+YWdsQ5ppO33aXY=

[barnjamin]

I just tested this and it seems to work for me, hash returned is: h1:j3+Jdnek/EnvxMoiBw9o3OtkDf3R+YWdsQ5ppO33aXY=

Maybe try go clean -modcache first and download it again?

Otherwise please provide some more info about your environment, OS/Go version/go.mod/go.sum

[arjanvaneersel]

I tried it in a brand new project. Steps I took are:

1. Create new project directory and enter it
2. go mod init
3. go get -u github.com/algorand/go-algorand-sdk/... (did not work, same checksum error, so continued with your suggestion)
4. go clean -modcache
5. go get -u github.com/algorand/go-algorand-sdk/... (again didn't work, same checksum error again)

OS: Arch linux Go: 1.17.7

go.mod is empty, because it's a new project and I can't install the Go SDK, therefore there is also no go.sum

module gitlab.com/plandail/infra/algotest

go 1.17

main.go

package main

import (
	"fmt"
	"strings"

	"github.com/algorand/go-algorand-sdk/client/kmd"
	"github.com/algorand/go-algorand-sdk/client/v2/algod"
)

var (
	algodAddress = "http://localhost:4001"
	algodToken   = strings.Repeat("a", 64) // contents of algod.token

	kmdAddress = "http://localhost:4002"
	kmdToken   = strings.Repeat("a", 64) // contents of kmd.token
)

func main() {
	// Create an algod client
	algodClient, err := algod.MakeClient(algodAddress, algodToken)
	if err != nil {
		return
	}

	// Create a kmd client
	kmdClient, err := kmd.MakeClient(kmdAddress, kmdToken)
	if err != nil {
		return
	}

	fmt.Printf("algod: %T, kmd: %T\n", algodClient, kmdClient)
}

Finally I also tried go mod tidy, but that results in the same error.

The complete error:

[arjan@arjan-dev1 algotest]$ go mod tidy
go: finding module for package github.com/algorand/go-algorand-sdk/client/kmd
go: finding module for package github.com/algorand/go-algorand-sdk/client/v2/algod
go: downloading github.com/algorand/go-algorand-sdk v1.12.0
gitlab.com/plandail/infra/algotest imports
	github.com/algorand/go-algorand-sdk/client/kmd: github.com/algorand/[email protected]: verifying module: checksum mismatch
	downloaded: h1:u2H9uhmQR+00P8sgaRJxTqmyJU52lKcPoCVRmMJCLu0=
	sum.golang.org: h1:j3+Jdnek/EnvxMoiBw9o3OtkDf3R+YWdsQ5ppO33aXY=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

gitlab.com/plandail/infra/algotest imports
	github.com/algorand/go-algorand-sdk/client/v2/algod: github.com/algorand/[email protected]: verifying module: checksum mismatch
	downloaded: h1:u2H9uhmQR+00P8sgaRJxTqmyJU52lKcPoCVRmMJCLu0=
	sum.golang.org: h1:j3+Jdnek/EnvxMoiBw9o3OtkDf3R+YWdsQ5ppO33aXY=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Let me know if you need more information.

[pbennett]

What is the output of the go env command. I suspect you might be using a proxy/artifact server of some sorts (ie: jfrog's artifact server) that is misbehaving.

[arjanvaneersel]

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/arjan/.cache/go-build"
GOENV="/home/arjan/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/arjan/Dev/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/arjan/Dev/go"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.7"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/arjan/Dev/go/src/gitlab.com/plandail/infra/algotest/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2083019010=/tmp/go-build -gno-record-gcc-switches"

[pbennett]

Did you install any kind of wrapper for the 'go' command? This just all sounds like the problems jfrog had with their early go artifact service where they were changing the data on return and the checksums were getting changed.

[arjanvaneersel]

No, I don't have any wrappers. Neither did I make any changes in the env settings of Go. If that would have been the case, then I would have had this issue with other repos as well, but it only occurs with the Algorand go sdk and this particular version. I was able to install 1.13.0-beta.1 without problems.

[winder]

Sounds like this is no longer an issue with the current releases. Please reopen if it happens again.