I recently started using modules in Go, but I frequently encounter issues where everything works fine on one machine, but a checksum mismatch is encountered when building the codebase on another machine.
The issue always concerns the same third party dependency (github.com/ericlagergren/decimal):
go: verifying github.com/ericlagergren/decimal@v0.0.0-20181231230500-73749d4874d5: checksum mismatch
downloaded: h1:HQGCJNlqt1dUs/BhtEKmqWd6LWS+DWYVxi9+Jo4r0jE=
go.sum: h1:x4oNpFLLl+8l+iLgksNHzZewTS0SKp6m0hlLwzXRbqA=
I've tried various things: removing & regenerating go.sum, upgrading Go itself to the latest patch version and removing the dependency from go.mod but nothing seems to fix this issue.
Does anyone have an idea how to fix this issue?
Which version of Go are you using? There's a good chance you're running into the aftermath of the 1.11.2 -> 1.11.4:
Which still isn't completely resolved. Remember that go mod is still in development, so things like this will probably happen up and until 1.13.
Be sure to read up on minor releases for Go, and how these things can happen: https://github.com/golang/go/wiki/MinorReleases
TL;DR - Upgrade Go
You can run go clean -modcache and then go mod tidy which will re-download all deps with the correct checksum.
I was having the same problem using 1.12.8 and no cache cleaning would help. Turns out I am still locked in the middle of GOPATH and the Mod world. I found a flag in another post (How do I migrate from Dep to Go Modules) that did the trick for me.
go run -mod=vendor main.go