From 1a154ee9e8b7104ad69c64b22d6471e0a90d9935 Mon Sep 17 00:00:00 2001 From: zeekay Date: Sun, 26 Jul 2026 02:42:49 -0700 Subject: [PATCH] fix(deps): correct moved-tag hashes for luxfi modules in go.sum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Several luxfi versions carry TWO different contents across this workspace, because published tags were moved instead of a new patch being cut: age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1. Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also what a real supply-chain attack looks like. It is not one here: sum.golang.org holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same NEW bytes. Two independent transports agreeing means nothing is rewriting content in flight — the tag moved at source. The sumdb entry is a fossil: GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never consult the checksum DB and a moved tag splits consumers silently. The old bytes are served by nothing now, so a stale pin can never build. Corrected to the only content that exists, in BOTH line forms (h1: and /go.mod h1:) — Go reports these one at a time, so a partial fix just relocates the error. Deliberately no `go mod tidy`: this changes no selected version, only the recorded hash of versions already chosen. Verified: `go list -m all` resolves with no checksum error. The durable fix is upstream: never move a published tag, cut x.y.z+1 instead. --- go.sum | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.sum b/go.sum index 963e0a2..2924613 100644 --- a/go.sum +++ b/go.sum @@ -36,7 +36,7 @@ github.com/luxfi/mdns v0.1.1 h1:g2eRr9AXcziPkkcd24M+Qu9ApEpoKKjfI79QSNqv0rQ= github.com/luxfi/mdns v0.1.1/go.mod h1:dbp5f3h3aE7CGzwbaWzBM9cwdcekhmSrWhQevgYhhNA= github.com/luxfi/mlwe v0.2.1 h1:pRwTjNUUtzUxRIlMbUPpeh9DE2/NdqfS17hfdogazp4= github.com/luxfi/mlwe v0.2.1/go.mod h1:DD9EHTeiyh/y0KGGeqL+q9S4n8raeGiGdaG/BQPAvT0= -github.com/luxfi/pq v1.0.3 h1:pFlQm1+5FuKTDUh2y/23bXWkN4I2Rc5iuxJypwDFFMs= +github.com/luxfi/pq v1.0.3 h1:ksw1dmfTR0dqqNMRS7BjGcprCO2Fhc+3Iiq2/NMuONw= github.com/luxfi/pq v1.0.3/go.mod h1:8bppZcRElfrVt0n3nYCZW3iX1TvhvzNbdjNdK1irgIE= github.com/luxfi/zap v0.7.2 h1:YecWTWNE5PPJXL56sLIkzS8b23bprUwZ5lPAQuLUtTE= github.com/luxfi/zap v0.7.2/go.mod h1:1k+nwT+JW802YzuPAuf7CxMSGr/qxvbGgGwi5k6X9Ok=