Repository navigation
go.mod: Avoid checksum failures from retagged Envoy version - #2963
Open
Paweł Gronowski (vvoland) wants to merge 1 commit into
Open
Paweł Gronowski (vvoland) wants to merge 1 commit into
Paweł Gronowski (vvoland) wants to merge 1 commit into
Conversation
Running go mod tidy with GOPROXY=direct failed checksum verification for Envoy v1.32.3. Upstream moved the tag after the Go proxy cached it, so direct downloads differed from both go.sum and the public checksum database. Go reached this version through transitive module requirements of the protobuf-generation tools. No hcsshim packages import Envoy, and its packages are not vendored. Excluded only v1.32.3 to avoid resolving the inconsistent release while keeping checksum verification enabled. Other Envoy versions remain available if hcsshim needs its packages in the future. Signed-off-by: Paweł Gronowski <git@grono.dev>
There was a problem hiding this comment.
🟢 Approval recommended
The targeted exclusion matches the documented upstream workaround without disabling checksum verification.
0 open findings
What changed in this PR
Adds a targeted module exclusion to avoid checksum failures caused by the retagged Envoy v1.32.3 release.
Changes:
- Excludes only the affected Envoy version.
- Documents the cause and links the upstream issue.
| File | Description |
|---|---|
go.mod |
Adds the Envoy v1.32.3 exclusion and rationale. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Justin (jterry75)
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Running go mod tidy with GOPROXY=direct failed checksum verification for Envoy v1.32.3. Upstream moved the tag after the Go proxy cached it, so direct downloads differed from both go.sum and the public checksum database.
Go reached this version through transitive module requirements of the protobuf-generation tools. No hcsshim packages import Envoy, and its packages are not vendored.
Excluded only v1.32.3 to avoid resolving the inconsistent release while keeping checksum verification enabled. Other Envoy versions remain available if hcsshim needs its packages in the future.