| Dan Willemsen | bc60c3c | 2021-12-15 01:09:00 -0800 | [diff] [blame] | 1 | # Test mismatched sums in go.sum files |
| 2 | |
| 3 | ! go run ./a |
| 4 | cmpenv stderr want-error |
| 5 | |
| 6 | -- want-error -- |
| 7 | verifying rsc.io/sampler@v1.3.0/go.mod: checksum mismatch |
| 8 | downloaded: h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= |
| 9 | $WORK${/}gopath${/}src${/}a${/}go.sum: h1:U1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= |
| 10 | |
| 11 | SECURITY ERROR |
| 12 | This download does NOT match an earlier download recorded in go.sum. |
| 13 | The bits may have been replaced on the origin server, or an attacker may |
| 14 | have intercepted the download attempt. |
| 15 | |
| 16 | For more information, see 'go help module-auth'. |
| 17 | -- go.work -- |
| 18 | go 1.18 |
| 19 | |
| 20 | use ./a |
| 21 | use ./b |
| 22 | -- a/go.mod -- |
| 23 | go 1.18 |
| 24 | |
| 25 | module example.com/hi |
| 26 | |
| 27 | require "rsc.io/quote" v1.5.2 |
| 28 | -- a/go.sum -- |
| 29 | rsc.io/sampler v1.3.0 h1:HLGR/BgEtI3r0uymSP/nl2uPLsUnNJX8toRyhfpBTII= |
| 30 | rsc.io/sampler v1.3.0/go.mod h1:U1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= |
| 31 | -- a/main.go -- |
| 32 | package main |
| 33 | |
| 34 | import ( |
| 35 | "fmt" |
| 36 | "rsc.io/quote" |
| 37 | ) |
| 38 | |
| 39 | func main() { |
| 40 | fmt.Println(quote.Hello()) |
| 41 | } |
| 42 | -- b/go.mod -- |
| 43 | go 1.18 |
| 44 | |
| 45 | module example.com/hi |
| 46 | |
| 47 | require "rsc.io/quote" v1.5.2 |
| 48 | -- b/go.sum -- |
| 49 | rsc.io/sampler v1.3.0 h1:HLGR/BgEtI3r0uymSP/nl2uPLsUnNJX8toRyhfpBTII= |
| 50 | rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= |
| 51 | -- b/main.go -- |
| 52 | package main |
| 53 | |
| 54 | import ( |
| 55 | "fmt" |
| 56 | "rsc.io/quote" |
| 57 | ) |
| 58 | |
| 59 | func main() { |
| 60 | fmt.Println(quote.Hello()) |
| 61 | } |