Build errors complaining about dependency checksum mismatch

[briancolecoinmetrics]

System information

Geth version: Whatever ships as bsc 1.0.7
OS & Version: Alpine Linux 3.13 in Docker
Commit hash : 1.0.7 tag so I guess f1d92be ?

Expected behaviour

make geth should succeed (exit code 0, produces binaries)

Actual behaviour

Build gets part way in and then errors out:

go: downloading github.com/matttproud/golang_protobuf_extensions v1.0.1
verifying github.com/btcsuite/btcd@v0.20.0-beta: checksum mismatch
        downloaded: h1:DnZGUjFbRkpytojHWwy6nfUSA7vFrzWXDLpFNzt74ZA=
        go.sum:     h1:PamBMopnHxO2nEIsU89ibVVnqnXR2yFTgGNc+PdG68o=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
util.go:45: exit status 1
exit status 1
make: *** [Makefile:16: geth] Error 1
The command '/bin/sh -c make geth' returned a non-zero code: 2

Most recent example: https://gitlab.com/coinmetrics/fullnodes/bsc/-/jobs/1235764534

Steps to reproduce the behaviour

We're building in Docker from https://gitlab.com/coinmetrics/fullnodes/bsc/-/blob/master/Dockerfile so should be as easy as

git clone https://gitlab.com/coinmetrics/fullnodes/bsc.git
cd bsc
./build.sh

[briancolecoinmetrics]

Oh better yet; I can reproduce this with your official Dockerfile too; just git checkout v1.0.7 && docker build . in a checkout from this repo creates the same error.

[briancolecoinmetrics]

Oh, it even reproduces on master.

[mtrimarchi]

Same problem here.

[timetaxy]

same as I..

[bsl]

Hi, I don't want to press anyone, but has this project been unbuildable for three days due possibly to a rogue version of some BTC-related dependency?

[briancolecoinmetrics]

Hi, I don't want to press anyone, but has this project been unbuildable for three days due possibly to a rogue version of some BTC-related dependency?

At least 6 days, actually; I got the initial build failure on 2021-04-30, and it took a few days to realize the problem wasn't on my end and open an issue.

[unclezoro]

Hi, guys. Apologies for the late response. There are some complaints about github.com/btcsuite/btcd@v0.20.0-beta, this repo drafts a release and deletes it and re-drafts it, so that causes the mismatch of checksum, anyway, I have bumped the version to v0.20.1-beta in this PR #194. You can fetch the latest code and recompile it.

[briancolecoinmetrics]

Any chance we can get that in a 1.0.7-hf.2 or such?

[CantelopePeel]

@guagualvcha this is pretty serious, many folks cannot build at the latest releases. Can you please as soon as readily possible make a stable release with this fixed? Or can you go and amend the prior releases?

When we get this error it makes it look like there is an ongoing MitM attack and it is not a good look for BSC.

[unclezoro]

https://github.com/binance-chain/bsc/releases/tag/v1.0.7-hf.2 released.

[bsl]

@guagualvcha Works for me now. Thank you, appreciated.

[unclezoro]

closing since it is fixed.