hanzoai/s3-csi
2
0
Fork 0
mirror of https://github.com/hanzoai/s3-csi.git synced 2026-09-30 23:52:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

deps: hanzoai/s3 v1.0.5 -> v1.0.15, the newest version that verifies

Browse Source 
The image build dies at `go mod download`:

  verifying github.com/hanzoai/[email protected]: checksum mismatch
    downloaded: h1:jyY5FGgOwXUT5gjuxYKAnvjmLNF3Mzchk6hfN0hqqec=
    go.sum:     h1:/hb8vroa+abcz+FzhU3PsT+bVg2lBNMioi4CGc36uTU=
  SECURITY ERROR

hanzoai/s3 v1.0.5 was re-cut after publication, so nothing reachable still
serves what this lockfile expects. Reproduced independently here with a clean
module cache against the PUBLIC proxy and GOSUMDB=sum.golang.org: the same
mismatch, same two hashes. This build has no GOPRIVATE at all — GOPROXY is
"https://proxy.golang.org,direct" — so there is no fetch path left that agrees
with the pin.

Rolling FORWARD rather than rewriting go.sum to the re-cut hash. Adopting the
new bytes under the old version number would make this repo disagree with the
signed database and would have to be redone the next time that tag moves.
Checked which releases actually verify, clean cache each time:

  v1.0.5    MISMATCH
  v1.0.13   OK
  v1.0.14   OK
  v1.0.15   OK

v1.0.15 is the newest and is a patch-level move within v1.0.x — no major bump.
It pulled one transitive upgrade, google/uuid v1.6.0 -> v1.6.1-0.20241114…

Verified: `go get` + `go mod tidy` exit 0 (so the whole graph verifies),
`go build ./...` and `go vet ./...` are both clean for linux/amd64 with
CGO_ENABLED=0 — the configuration the image actually builds — and a pristine
`go mod download` reports zero mismatches. The local host cannot build cgo
targets (its SDK is missing stdlib.h/errno.h), which is unrelated and is why the
target triple is used for verification.

Worth stating: this is the fourth re-cut first-party tag hit today (luxfi
consensus and vm, hanzoai orm, now hanzoai s3). Re-cutting a published version
breaks every consumer that pinned it, silently, until they next resolve.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-07-28 06:33:40 -07:00
co-authored by Hanzo Dev
parent c7986bcc4d
commit 8838c3ac29
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+2 -2
View File
@@ -10,7 +10,7 @@ require (
)
require (
github.com/hanzoai/s3 v1.0.5
github.com/hanzoai/s3 v1.0.15
golang.org/x/sys v0.47.0
k8s.io/api v0.32.0
k8s.io/apimachinery v0.32.0
@@ -36,7 +36,7 @@ require (
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/hanzoai/goexif v1.0.4 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
go.sum
+6 -6
View File
@@ -51,16 +51,16 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 h1:UBg1xk+oAsIVbFuGg6hdfAm7EvCv3EL80vFxJNsslqw=
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
github.com/hanzoai/goexif v1.0.4 h1:ttNObsfiO3z8A4jA91l3YtMELGAXyMfVr8ckgNm9AwE=
github.com/hanzoai/goexif v1.0.4/go.mod h1:eZsa4Rlv4Vqf/hGAjq5kRGBQTDDiZdkqsw6vEXTs3p4=
github.com/hanzoai/s3 v1.0.5 h1:/hb8vroa+abcz+FzhU3PsT+bVg2lBNMioi4CGc36uTU=
github.com/hanzoai/s3 v1.0.5/go.mod h1:JEK/+JeTzioEYro9bc4JrgSjsFJlz+WCIyXENTavafs=
github.com/hanzoai/s3 v1.0.15 h1:qxD3BX3EfkgHSciM1SgDblJ5mWY30a8kMF/QH1dyQ1I=
github.com/hanzoai/s3 v1.0.15/go.mod h1:GFmaDuNjmvtLDe6aa7HZ7yWcZydRjPOPBlH6+oovZCc=
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=