Description

ea7769f broke the build on main:

2024-03-25T22:34:26.8827740Z verifying github.com/Microsoft/[email protected]: checksum mismatch
2024-03-25T22:34:26.8828716Z downloaded: h1:qbmS+ZplURcyTJi8IseYDay+FdDdtHqtjxg5e4/PlPw=
2024-03-25T22:34:26.8829367Z go.sum: h1:ahSMCguNOQMvTV7wWLknLhpieyqA2hUyEb3j6R+6B/c=
2024-03-25T22:34:26.8829752Z
2024-03-25T22:34:26.8829862Z SECURITY ERROR
2024-03-25T22:34:26.8830294Z This download does NOT match an earlier download recorded in go.sum.
2024-03-25T22:34:26.8830971Z The bits may have been replaced on the origin server, or an attacker may
2024-03-25T22:34:26.8831518Z have intercepted the download attempt.

[email protected] may have changed on the origin before Dependabot downloaded it.

Steps to reproduce the issue

1. Clone main branch
2. go mod tidy to delete package cache
3. Attempt to build nerdctl

Describe the results you received and expected

Received:

2024-03-25T22:34:26.8827740Z verifying github.com/Microsoft/[email protected]: checksum mismatch
2024-03-25T22:34:26.8828716Z downloaded: h1:qbmS+ZplURcyTJi8IseYDay+FdDdtHqtjxg5e4/PlPw=
2024-03-25T22:34:26.8829367Z go.sum: h1:ahSMCguNOQMvTV7wWLknLhpieyqA2hUyEb3j6R+6B/c=
2024-03-25T22:34:26.8829752Z
2024-03-25T22:34:26.8829862Z SECURITY ERROR
2024-03-25T22:34:26.8830294Z This download does NOT match an earlier download recorded in go.sum.
2024-03-25T22:34:26.8830971Z The bits may have been replaced on the origin server, or an attacker may
2024-03-25T22:34:26.8831518Z have intercepted the download attempt.

Expected: perfect build.

What version of nerdctl are you using?

master

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information