SECURITY ERROR: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch

[mjnowen]

go get github.com/hashicorp/consul/api has a bad checksum that is now present when GOPROXY=direct only. Looks like a bad release in v1.33.3. Please can you fix ASAP.

go: downloading github.com/hashicorp/consul/api v1.33.3
go: github.com/hashicorp/consul/api@v1.33.3: verifying module: checksum mismatch
        downloaded: h1:XLKUXPJb9foOI2npcv+1lTgV0YpA71wvvkuh+59NQXY=
        sum.golang.org: h1:6ttDO8Os/lqwaus7nJxJaeiUw2o7GWKoQ1jexAFPdEQ=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

[mjnowen]

Most likely cause is when a TAG was re-pushed or changed after the sum DB has already been filled. A new release is required to cleanly fix this issue. Release process should ensure that nobody is allowed to re-push a TAG if that was the root cause.

[mjnowen]

An ill-advised work-around is:

export GONOSUMDB=github.com/hashicorp/consul
go get ...

[gizmoguy]

ping @hc-github-team-es-release-engineering

[gizmoguy]

Fixed by api/v1.33.4