v2.8.0 tag does not match checksum

[lengrongfu]

If you are reporting a problem, please make sure the following information are provided:

Expected behavior and actual behavior:

$ src git:(main) go mod tidy
go: downloading github.com/docker/distribution v2.8.0+incompatible
verifying github.com/docker/[email protected]+incompatible: checksum mismatch
        downloaded: h1:u9vuu6qqG7nN9a735Noed0ahoUm30iipVRlhgh72N0M=
        go.sum:     h1:l9EaZDICImO1ngI+uTifW+ZYvvz7fKISBAKpg+MbWbY=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Steps to reproduce the problem: Please provide the steps to reproduce this problem.

Versions: Please specify the versions of following systems.

• harbor operator version: [main]
• harbor version: [x.y.z]
• kubernetes version: [x.y.z]
• Any additional relevant versions such as CertManager

Additional context:

• Harbor dependent services:
  • Context info of postgreSQL
  • Context info of Redis
  • Context info of storage
• Log files: Collect logs and attach them here if have.
• Kubernetes: How Kubernetes access was provided (what cloud provider, service-account configuration, ...).

[lengrongfu]

ref: https://github.com/distribution/distribution/issues/3590 ref: https://github.com/goharbor/harbor/issues/17295

[lengrongfu]

/assign