proxy.golang.org: incorrect ZIP for github.com/aws/[email protected]

[RomainMuller]

What version of Go are you using (go version)?

$ go version
go version go1.16.2 darwin/amd64

Does this issue reproduce with the latest release?

Yep.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/rmuller/Library/Caches/go-build"
GOENV="/Users/rmuller/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/rmuller/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/rmuller/go"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/usr/local/Cellar/go/1.16.2/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.16.2/libexec/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.16.2"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/rmuller/Development/Demos/Go/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/tg/vz53g2791rzc2h_86hxxz1cc0000gr/T/go-build2736582915=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Attempt to go mod download github.com/aws/jsii/[email protected] when GOPROXY=direct.

What did you expect to see?

Expected to obtain the same data from proxy.golang.org and direct.

What did you see instead?

$ GOPROXY=direct go mod download -json "github.com/aws/[email protected]"
go: github.com/aws/aws-cdk-go/[email protected] requires
	github.com/aws/[email protected]: verifying go.mod: checksum mismatch
	downloaded: h1:+9t6P1aXlPO0lXa8LtXGBUTcf5tbUekFFFQ4ewFIqAk=
	sum.golang.org: h1:9ddMDdGQwew6pQrfuTID/LxDDrpyrybwsWN84etzjQ8=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

This is because the ZIP file cached (and hashed) at proxy.golang.org for this version is actually the code from version 1.26.0.

At this stage I am not sure how this happened. We published github.com/aws/[email protected] about 6 days ago to GitHub and have not done any force-push or re-publish on that as far as I know. I also don't know that the tag has been moved or anything.

The cached entry on the proxy should be invalidated and re-fetched? If there is any indications to how this happened, and it is because of how we did things - please educate us!

[RomainMuller]

Looking at the proxy, it appears 1.27.0 was somehow "created" at the same time as 1.26.0 was:

$ curl -L "https://proxy.golang.org/github.com/aws/jsii-runtime-go/@v/v1.27.0.info"
{"Version":"v1.27.0","Time":"2021-03-22T15:53:25Z"}%
$ curl -L "https://proxy.golang.org/github.com/aws/jsii-runtime-go/@v/v1.26.0.info"
{"Version":"v1.26.0","Time":"2021-03-22T15:53:25Z"}%

The commit for 1.26.0 is aws/jsii-runtime-go@ec37187 (March 22nd).
The one for 1.27.0 is aws/jsii-runtime-go@8c33a80 (April 6th).

The ZIP files do however differ (they have different checksums, at least).

[FiloSottile]

It is not possible to invalidate an existing version in the Checksum Database, as it is an immutable log by design.

Concretely, your best option is to publish a v1.27.1, and optionally retract v1.27.0.

To understand how this happened, I recommend looking at the GitHub events API, which will show whether a v1.27.0 tag was temporarily created and then deleted.

[RomainMuller]

Alright - thanks for pointing me to the events API... It explains... everything.

Looks like we're on to actually retract this version and publish another one!