go 1.11.4 mod checksum errors

[nictuku]

$ go version
go version go1.11.4 linux/amd64

$ go get ./...

or

$ go mod download
go: verifying gotest.tools@v2.2.0+incompatible: checksum mismatch
downloaded: h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
go.sum: h1:y0IMTfclpMdsdIbr6uwmJn5/WZ7vFuObxDMdrylFM3A=

Switch to Go 1.11.3

Nuke $GOPATH/pkg/mod/cache

Repeat go get ./... or go mod download, and it works.

I'm creating a simple repo with repro steps now.

[nictuku]

Perhaps this was because the checksums created by 1.11.3 were the "wrong" ones? So nuking the cache is probably fine?

[dotwaffle]

No, definitely not 1.11.3, my checksum was made back in August and is broken as of 1.11.4, whereas it worked with 1.11 thru 1.11.3 without showing errors:

go: verifying github.com/grpc-ecosystem/go-grpc-middleware@v1.0.0: checksum mismatch
    downloaded: h1:Iju5GlWwrvL6UBg4zJJt3btmonfrMlCDdsejg4CZE7c=
    go.sum:     h1:BWIsLfhgKhV5g/oF34aRjniBHLTZe5DNekSjbAjIS6c=

[agnivade]

/cc @bcmills @myitcv

[bcmills]

Yes, pre-1.11.4, modules containing symlinks were constructed erroneously. 1.11.4 correctly omits those symlinks, which may change the sums for a few (hopefully isolated) modules.

[bcmills]

See #27093.

[nictuku]

It sounds like we can close this issue. It's an inconvenient but ultimately benign error caused by previous versions.

It can be worked around by manually updating (or simply removing) the appropriate lines from go.sum.

[thepudds]

Note: if you have a copy of a module with symlinks in your module cache, you likely will need to run go clean -modcache in order to get 1.11.4 to generate the new (corrected) checksum. (e.g., see #29282)