1

I am getting errors when I ran, using go version go1.15.7 darwin/amd64

go get go.mongodb.org/mongo-driver

go: downloading go.mongodb.org/mongo-driver v1.4.5
go get go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver@v1.4.5: verifying module: checksum mismatch
    downloaded: h1:z4/YQzLTxI+ymcrS//Wc2JBn2b9ojvpVH3BaYT8rqUc=
    sum.golang.org: h1:TLtO+iD8krabXxvY1F1qpBOHgOxhLWR7XsT7kQeRmMY=


SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

Any ideas? Thanks.

user2002692
  • 971
  • 2
  • 17
  • 34

1 Answers1

0

Before you apply this, you might want to check why the checksum is different. There might be a security issue and someone might try to inject malicious code into the dependency. That is what checksums are there to prevent. They make sure the checksum of the package you are downloading is the same you downloaded earlier (if the version is the same).

Solution

Delete the go.mongodb.org/mongo-driver related checksum from go.sum file in your repository.

If that does not help a cleanup of your modules cache might help:

go clean -modcache
TehSphinX
  • 6,536
  • 1
  • 24
  • 34
  • I only have 3 things in my go.mod right now: `github.com/golang/protobuf v1.4.3` `google.golang.org/grpc v1.35.0` `google.golang.org/protobuf v1.25.0` I dont see anything related to `go.mongodb.org/mongo-driver` in go.sum, I also tried `go clean -modcache`, still does not work – user2002692 Feb 01 '21 at 15:44
  • did you try the `go clean -modcache`? – TehSphinX Feb 01 '21 at 15:45
  • When I call a `go get` it works and adds this checksum to my go.sum file: `go.mongodb.org/mongo-driver v1.4.5 h1:TLtO+iD8krabXxvY1F1qpBOHgOxhLWR7XsT7kQeRmMY=` – TehSphinX Feb 01 '21 at 15:52
  • 1
    Here another thread on a similar issue: https://stackoverflow.com/questions/54133789/go-modules-checksum-mismatch It mostly suggests the same I did. Not sure why it is not working for you. – TehSphinX Feb 01 '21 at 15:56
  • Or maybe you are still using GOPATH a bit? Maybe an old version of `mongo-driver` is still in your `GOPATH/src` folder? – TehSphinX Feb 01 '21 at 15:59
  • 1
    I just succesfully downloaded it with `go get go.mongodb.org/mongo-driver/mongo@v1.4.4`, seems like without specifying the version number, it tries to download 1.4.5, which has the problem – user2002692 Feb 01 '21 at 16:08
  • This seems to be an issue with version 1.4.5 specifically: https://jira.mongodb.org/projects/GODRIVER/issues/GODRIVER-1851?filter=allopenissues – Ivan Feb 02 '21 at 10:39