Build error for checksum mismatch

[haytok]

Sorry for the basic question.

When trying to build an environment to build nerdctl according to the Developer Guide in README.md, the build fails due to a checksum mismatch.

[haytok@lima-finch nerdctl]$ date
Sat Sep 21 01:26:34 AM JST 2024
[haytok@lima-finch tmp]$ git clone https://github.com/containerd/nerdctl.git
Cloning into 'nerdctl'...
remote: Enumerating objects: 24507, done.
remote: Counting objects: 100% (4821/4821), done.
remote: Compressing objects: 100% (664/664), done.
remote: Total 24507 (delta 4501), reused 4157 (delta 4155), pack-reused 19686 (from 1)
Receiving objects: 100% (24507/24507), 9.38 MiB | 25.15 MiB/s, done.
Resolving deltas: 100% (16859/16859), done.
[haytok@lima-finch tmp]$ ls
nerdctl
[haytok@lima-finch tmp]$ cd nerdctl/
[haytok@lima-finch nerdctl]$ ls
cmd  Dockerfile  Dockerfile.d  docs  EMERITUS.md  examples  extras  go.mod  go.sum  hack  LICENSE  MAINTAINERS  MAINTAINERS_GUIDE.md  Makefile  NOTICE  pkg  README.md  SECURITY.md  Vagrantfile.freebsd
[haytok@lima-finch nerdctl]$ make
CGO_ENABLED=0 GOOS=linux go -C /Users/haytok/workspace/tmp/nerdctl build -ldflags "-s -w  -X github.com/containerd/nerdctl/v2/pkg/version.Version=v2.0.0-rc.2-14-ga40889bf -X github.com/containerd/nerdctl/v2/pkg/version.Revision=a40889bf138c8da4e52432af73a13b914ab81299"   -o /Users/haytok/workspace/tmp/nerdctl/_output/nerdctl ./cmd/nerdctl
verifying github.com/containerd/accelerated-container-image@v1.2.2: checksum mismatch
	downloaded: h1:nZswvJke9OW5lXkzc1uppWn2Tnd2nqdGLEc17zppS3o=
	go.sum:     h1:GzBaFYyA3JFJGor9de1tX2aLSIG1vIewdNzJrcP3dco=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
make: *** [Makefile:63: nerdctl] Error 1

I thought the build would succeed just by doing make, is there anything additional I need to do to get it to build?

Running rm go.sum and go clean -modcache and then building again does not solve the problem.

Note that my development environment is Lima and I am building nerdctl.

[haytok@lima-finch nerdctl]$ go version
go version go1.22.7 linux/arm64
[haytok@lima-finch nerdctl]$ uname -a
Linux lima-finch 6.8.9-300.fc40.aarch64 #1 SMP PREEMPT_DYNAMIC Thu May  2 19:17:51 UTC 2024 aarch64 GNU/Linux
[haytok@lima-finch nerdctl]$ cat go.* | grep accelerated-container-image
	github.com/containerd/accelerated-container-image v1.2.2
github.com/containerd/accelerated-container-image v1.2.2 h1:GzBaFYyA3JFJGor9de1tX2aLSIG1vIewdNzJrcP3dco=
github.com/containerd/accelerated-container-image v1.2.2/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=

[apostasie]

@haytok there is nothing extra to be done, and it should work.
I am using lima too, and it is working fine for me.

Are you using a specific go proxy? Or are you otherwise on a (corporate) network that would possibly intercept / manipulate your traffic? What happens if you use a VPN (or tunnel your traffic over ssh to a remote machine)?

[haytok]

Thanks for your comments and confirmation!

We do not use proxy or VPN and are connected to the internet, not the corporate network.
Also, the repositories are up-to-date.

Note that the event occurred on Amazon Linux 2023 on EC2 as well, not on Lima booted on a Mac Book ....

[apostasie]

I think we have seen that before - someone mentioned a checksum mismatch as well (on unrelated dependency).
This is really baffling.
At this point, I am ready to blame the default goproxy, or go mod...
Can you try with direct to bypass the default goproxy? (something like go env -w GOPROXY=direct)

[haytok]

Thanks for the advice!
Deleting the Lima VM and volume solved the problem.
The root cause is unknown, but the problem has been resolved, so this QA is closed!
Thank you for your help.

[apostasie]

You are welcome @haytok
If you ever hit it again, give me a ping and let's try to pinpoint what is faulty.