Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependency "github.com/gin-gonic/gin" #783

Open
Ben131-Go opened this issue Feb 4, 2023 · 0 comments
Open

Upgrade dependency "github.com/gin-gonic/gin" #783

Ben131-Go opened this issue Feb 4, 2023 · 0 comments

Comments

@Ben131-Go
Copy link

Background

Module github.com/WeBankPartners/open-monitor/monitor-server depends on github.com/gin-gonic/[email protected].

https://github.com/WeBankPartners/open-monitor/blob/master/monitor-server/go.mod#L8

However, comparing version v1.7.3 of github.com/gin-gonic/gin from proxy.golang.org and github, there are inconsistencies.

commit time of the copy on github.com

"committer": {
      "name": "Bo-Yi Wu",
      "email": "[email protected]",
      "date": "2021-08-03T02:40:44Z"
    }

commit time of the copy on proxy.golang.org

{"Version":"v1.7.3","Time":"2021-08-03T02:36:43Z"}

So the checksum from the code in github does not match the checksum saved in sum.golang.org. The v1.7.3 tag of github.com/gin-gonic/gin might have been retagged after a minor edition on github. I guess you use proxy.golang.org to get dependencies, but that also shows that your project is depending on the copy of github.com/gin-gonic/[email protected] before its edition. Depending upon such inconsistent tag version may also result in some unexpected errors as well as build errors due to different proxy settings.

For example, when someone who does not use proxy.golang.org, say GOPROXY=direct, attempts to get github.com/gin-gonic/[email protected], the following error occurs.

go: downloading github.com/gin-gonic/gin v1.7.3
go: github.com/gin-gonic/gin@v1.7.3: verifying module: checksum mismatch
        downloaded: h1:3U500Wp728rATEiFJtk1L7dhAbWobNDQC0Cbd4yhhdc=
        sum.golang.org: h1:aMBzLJ/GMEYmv1UWs2FFTcPISLrQH2mRgL9Glz8xows=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

So, this is a reminder in the hope that you can get rid of this problematic version of project github.com/gin-gonic/gin.

Solution

1. Bump the version of dependency github.com/gin-gonic/gin

I would recommend bumping the version of github.com/gin-gonic/gin to a new release to ensure dependency copy in proxy.golang.org and github in sync.

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant