sum.golang.org: checksum mismatch for apache/thrift@v0.12.0

[rubensayshi]

What version of Go are you using (go version)?

go version go1.13 darwin/amd64

What operating system and processor architecture are you using (go env)?

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/ruben/Library/Caches/go-build"
GOENV="/Users/ruben/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GONOPROXY="gitlab.prvbl.com"
GONOSUMDB="gitlab.prvbl.com"
GOOS="darwin"
GOPATH="/work/goworkspace/global"
GOPRIVATE="gitlab.prvbl.com"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/ruben/.gimme/versions/go1.13.darwin.amd64"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/ruben/.gimme/versions/go1.13.darwin.amd64/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/work/gomodthrift/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/w1/jztswldd2v77s23x6nnzhx5r0000gn/T/go-build054837902=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

$ go mod init gomodapachethrifttest
$ go mod edit -require github.com/apache/thrift@v0.12.0
$ go mod download
verifying github.com/apache/thrift@v0.12.0: checksum mismatch 
downloaded: h1:ymFY8b00T66exzV1OxAnIA8mawFjPyH6l0wjuv8zTxY= 
sum.golang.org: h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs=

What did you expect to see? / What did you see instead?

I expected the downloaded package to match the checksum.

I created a ticket with in the thrift issue tracker as well; https://issues.apache.org/jira/browse/THRIFT-4948

[ALTree]

cc @katiehockman

[bcmills]

The h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs= checksum seems to be correct: it matches what I get with go1.12.9, and with go1.13 with GOPROXY=direct.

example.com$ go1.12.9 mod init example.com
go: creating new go.mod: module example.com

example.com$ go1.12.9 get -d github.com/apache/thrift@v0.12.0
go: finding github.com/apache/thrift v0.12.0
go: downloading github.com/apache/thrift v0.12.0
go: extracting github.com/apache/thrift v0.12.0

example.com$ cat go.sum
github.com/apache/thrift v0.12.0 h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs=
github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=

[bcmills]

I see the other checksum using an older go1.11 build; you probably got it into your local cache that way. (There was a bug in Go 1.11's handling of symlinks, and unfortunately when we fixed that we broke the existing checksums for repos containing symlinks. That won't happen again.)

[bcmills]

Duplicate of #29278

[rubensayshi]

ye, purging my local go mod cache indeed fixes the issue <3