distribution: v2.8.0 tag does not match checksum

I get the following error when attempting to run go mod tidy on a project that depends on this module.

        github.com/docker/distribution/registry/api/errcode: github.com/docker/distribution@v2.8.0+incompatible: verifying module: checksum mismatch
        downloaded: h1:u9vuu6qqG7nN9a735Noed0ahoUm30iipVRlhgh72N0M=
        sum.golang.org: h1:l9EaZDICImO1ngI+uTifW+ZYvvz7fKISBAKpg+MbWbY=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 16 (6 by maintainers)

Commits related to this issue

Downgrade docker/distributions to 2.8.0-beta.1 docker/distributions 2.8.0 has an invalid checksum recorded in the golang checksum db. Its an irrevocable operation and we have to wait for a correct 2.... — committed to chrisdoherty4/tinkerbell-tink by chrisdoherty4 2 years ago
Downgrade docker/distributions to 2.8.0-beta.1 docker/distributions 2.8.0 has an invalid checksum recorded in the golang checksum db. Its an irrevocable operation and we have to wait for a correct 2.... — committed to chrisdoherty4/tinkerbell-tink by chrisdoherty4 2 years ago
Downgrade docker/distributions to 2.8.0-beta.1 docker/distributions 2.8.0 has an invalid checksum recorded in the golang checksum db. Its an irrevocable operation and we have to wait for a correct 2.... — committed to chrisdoherty4/tinkerbell-tink by chrisdoherty4 2 years ago
Downgrade docker/distributions to 2.8.0-beta.1 (#593) docker/distributions 2.8.0 has an invalid checksum recorded in the golang checksum db. Its an irrevocable operation and we have to wait for a cor... — committed to tinkerbell/tink by mergify[bot] 2 years ago
Update github.com/distribution/distribution Version v2.8.1 fixes an invalid checksum in gosumdb raising a security error, see: https://github.com/distribution/distribution/issues/3590 Signed-off-by:... — committed to lcarva/chains by lcarva 2 years ago
Update github.com/distribution/distribution Version v2.8.1 fixes an invalid checksum in gosumdb raising a security error, see: https://github.com/distribution/distribution/issues/3590 Signed-off-by:... — committed to tektoncd/chains by lcarva 2 years ago
Update github.com/distribution/distribution to fix checksum error Known issue upstream: https://github.com/distribution/distribution/issues/3590 resolved by 2.8.1 release. Also see: https://github.... — committed to ameukam/promo-tools by ameukam 2 years ago
Update github.com/distribution/distribution to fix checksum error Known issue upstream: https://github.com/distribution/distribution/issues/3590 resolved by 2.8.1 release. Also see: https://github.... — committed to ameukam/promo-tools by ameukam 2 years ago
chore(deps): bump docker distribution for checksum mismatch - bumps github.com/docker/distribution from v2.8.0 from v2.8.1 - see https://github.com/distribution/distribution/issues/3590 — committed to bellrocktech/directpv by gnanderson 2 years ago
chore(deps): bump docker distribution for checksum mismatch - bumps github.com/docker/distribution from v2.8.0 to v2.8.1 - see https://github.com/distribution/distribution/issues/3590 — committed to bellrocktech/directpv by gnanderson 2 years ago
Upgrade indirect deps Fixes the build which was broken in https://github.com/distribution/distribution/issues/3590 — committed to matrix-org/complement by kegsay 2 years ago
Upgrade indirect deps (#376) Fixes the build which was broken in https://github.com/distribution/distribution/issues/3590 — committed to matrix-org/complement by kegsay 2 years ago
Update docker/distribution to v2.8.1 The version tag v2.8.0 was moved to a new commit causing security alerts to be triggered when it is fetched by golang. See details in https://github.com/distribut... — committed to lcarva/ec-cli by lcarva 2 years ago
Update docker/distribution from 2.8.0 to 2.8.1 Cartridge CLI build fails with a checksum mismatch error on Fedora 36. 2.8.1 release of docker/distribution adresses this issue. See also distribution/... — committed to tarantool/cartridge-cli by psergee 2 years ago
Update docker/distribution from 2.8.0 to 2.8.1 Cartridge CLI build fails with a checksum mismatch error on Fedora 36. 2.8.1 release of docker/distribution addresses this issue. See also distribution... — committed to tarantool/cartridge-cli by psergee 2 years ago
dependency: update docker/distribution from 2.8.0 to 2.8.1 Cartridge CLI build fails with a checksum mismatch error on Fedora 36. 2.8.1 release of docker/distribution addresses this issue. See also ... — committed to tarantool/cartridge-cli by psergee 2 years ago
dependency: update docker/distribution from 2.8.0 to 2.8.1 Cartridge CLI build fails with a checksum mismatch error on Fedora 36. 2.8.1 release of docker/distribution addresses this issue. See also ... — committed to tarantool/cartridge-cli by psergee 2 years ago
update github.com/docker/distribution to fix checksum error When trying to build, we get this error: ``` verifying github.com/docker/distribution@v2.8.0+incompatible: checksum mismatch downl... — committed to vincentbernat/containerlab by vincentbernat 2 years ago
chore(deps): bump docker distribution for checksum mismatch (#589) - bumps github.com/docker/distribution from v2.8.0 to v2.8.1 - see https://github.com/distribution/distribution/issues/3590 — committed to minio/directpv by gnanderson 2 years ago
deps: update dependencies fix distribution by updating to 2.8.1 first see https://github.com/distribution/distribution/issues/3590 Signed-off-by: Yves Brissaud <yves.brissaud@docker.com> — committed to docker/scan-cli-plugin by eunomie 2 years ago

Most upvoted comments

The version is v2.8.0+incompatible and is in the sum.golang.org database at https://sum.golang.org/lookup/github.com/docker/distribution@v2.8.0+incompatible.

The best fix, if the original commit cannot be restored for v2.8.0+incompatible would be to publish a new v2.8.1+incompabtible release with a v2.8.1 tag.

Aneurysm9 on Feb 23, 2022

I think the issue can be closed? @milosgajdos

chrisdoherty4 on Mar 18, 2022

lgtm

chrisdoherty4 on Mar 8, 2022

We managed to reproduce this locally, If you look here https://sum.golang.org/lookup/github.com/docker/distribution@v2.8.0 you won’t find the sum there.

We think the Go sumdb contains some cached Go sum – the best course of action is to delete the Go sum db ($GOPATH/pkg/sumdb) and re-pull and everything will work fine.

milosgajdos on Feb 23, 2022