charmbracelet/glamour checksum mismatch #920
Description
Describe the bug
Trying to build this locally (on MacOS, not sure if that's relevant), go complains with this error:
verifying github.com/charmbracelet/[email protected]: checksum mismatch
downloaded: h1:Q7PdJLOx8EoepsXUvW6Puz5WQ3YUElIGQdYKrIpiGLA=
go.sum: h1:11dEfiGP8q1BEqvGoIjivuc2rBk+5qEXdPtaQ2WoiCM=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
To Reproduce
Steps to reproduce the behavior:
make build
Additional context
If I rm go.sum and run go mod tidy, I get a different checksum, however, Github Actions seems to fail, saying there's a mismatch.
I also noticed this has occurred a number of times with glamour, including in their 0.10.0 release.
I'm unsure if this is a caching issue in CI or some other issue, possibly related to the use (or lack of):
export GOPROXY="https://proxy.golang.org,direct"
export GOSUMDB="sum.golang.org"