v1.16 build is broken

[fhuberts]

Gitea Version

039eb66

Git Version

039eb66

Operating System

Fedora Linux

How are you running Gitea?

not relevant

Database

No response

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

When building gitea I get a checksum error.
The component was updated in commit 039eb66

...
go: downloading github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
go: downloading github.com/klauspost/cpuid v1.3.1
go: downloading github.com/mattn/go-isatty v0.0.13
verifying github.com/niklasfasching/go-org@v1.6.0: checksum mismatch
downloaded: h1:CRDpKE90NuksNOWe7qjq1JHh7yonOht8f7rzAJQSDhc=
go.sum: h1:NCWpmDDNjHNsrei6VmnYXzOiyZUxV8LVU19REGQ8dKA=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
make: *** [Makefile:589: generate] Error 1

Screenshots

No response

[fhuberts]

I'm building on Fedora 35 x64, go version: golang-1.16.14-1.fc35.x86_64

[fhuberts]

Reverting that commit makes the build work again

[zeripath]

Have you ran:

make vendor

[fhuberts]

No I haven't.
The doc page about building from source doesn't mention it and it was never needed before.

[fhuberts]

Have tried it and I get the same error

...
go: downloading github.com/syndtr/goleveldb v1.0.0
go: downloading github.com/ethantkoenig/rupture v1.0.0
go: downloading github.com/olivere/elastic/v7 v7.0.25
verifying github.com/niklasfasching/go-org@v1.6.0: checksum mismatch
	downloaded: h1:CRDpKE90NuksNOWe7qjq1JHh7yonOht8f7rzAJQSDhc=
	go.sum:     h1:NCWpmDDNjHNsrei6VmnYXzOiyZUxV8LVU19REGQ8dKA=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
make: *** [Makefile:373: vendor] Error 1

[42wim]

Same issue on my build, when building release 1.6.2

There is an issue with the module on proxy.golang.org and the one directly on github, the v1.6.0 tag has probably changed (force pushed) on github

Try docker build . --build-arg GOPROXY=http://proxy.golang.org and the build will work

(or export GOPROXY=http://proxy.golang.org when not building using the Dockerfile)

[fhuberts]

Same issue on my build, when building release 1.6.2

There is an issue with the module on proxy.golang.org and the one directly on github, the v1.6.0 tag has probably changed (force pushed) on github

Then the build should be fixed by gitea people. Leaving an inconsistency like this in the build is asking for problems.
More so because the source of the inconsistency is unknown at this time.
The module, or the proxy, might even be compromised...

Might be a good idea to reach out to the developer of the module and the proxy people...

Try docker build . --build-arg GOPROXY=http://proxy.golang.org and the build will work

(or export GOPROXY=http://proxy.golang.org when not building using the Dockerfile)

I'm not really inclined to do this. It's a bit asking builders to jump through hoops to make it work.

[42wim]

btw you can do curl -o v1.6.0.zip https://proxy.golang.org/github.com/niklasfasching/go-org/@v/v1.6.0.zip to get the module the proxy has compared with what the github one has. If you want to check about the compromise.

Then the build should be fixed by gitea people.

Not something the gitea people really can fix, seems like upstream changed tags after releasing the module.
The github.com/niklasfasching/go-org repo should retag

I'm not really inclined to do this. It's a bit asking builders to jump through hoops to make it work.

Well, the default is actually using the proxy and the gitea docker build itself also uses a proxy: see https://drone.gitea.io/go-gitea/gitea/51582/6/3 /usr/local/bin/docker build --rm=true -f Dockerfile -t 8ebf0e68ec2899584cef9cf0674a2c4650c00823 . --pull=true --build-arg GOPROXY=https://goproxy.cn

[fhuberts]

Ok clear. I'll consider adding that to my build.
Maybe this should then also be documented on the 'building from source' page?

tnx

[fhuberts]

I've filed issue niklasfasching/go-org#72 to notify the developer of the inconsistency

[fhuberts]

The developer has tagged a new version.
You can use that to get rid of the inconsistency.