mirror of
https://github.com/luxfi/go-bip39.git
synced 2026-07-27 01:14:41 +00:00
zeekay
48c639e22a
Several luxfi versions carry TWO different contents across this workspace, because published tags were moved instead of a new patch being cut: age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1. Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also what a real supply-chain attack looks like. It is not one here: sum.golang.org holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same NEW bytes. Two independent transports agreeing means nothing is rewriting content in flight — the tag moved at source. The sumdb entry is a fossil: GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never consult the checksum DB and a moved tag splits consumers silently. The old bytes are served by nothing now, so a stale pin can never build. Corrected to the only content that exists, in BOTH line forms (h1: and /go.mod h1:) — Go reports these one at a time, so a partial fix just relocates the error. Deliberately no `go mod tidy`: this changes no selected version, only the recorded hash of versions already chosen. Verified: `go list -m all` resolves with no checksum error. The durable fix is upstream: never move a published tag, cut x.y.z+1 instead.
3 lines
159 B
Plaintext
3 lines
159 B
Plaintext
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
|
|
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
|