v1.12.1 hash mismatch

[furiel]

When I tried to download v1.12.1, I noticed there is a hash mismatch between the downloaded artifact and the sum that is stored on sum.golang.org.

This is what I see when I download the artifact: "Sum": "h1:t/CM3q/IRe7bRsm/lgpkuvqk/M0i4/M+3gpL3JMQayI="
And this is what is published: h1:LzcZ6SqJRH2EULBz3Paa1t1uzQaaoo9domuz8FQDkiY=

I wonder what the root cause may be. I noticed there was a typo fixup in changelog, and an issue talking about failed release and a possible github bug.

Is it possible that the release tag was force pushed due to these changes, and for some reason sum.golang.org did not pick up the new hash?

Ps: there is a high chance this is an user error on my side: although I get this strange different artifact consistently, when I asked my colleagues to clear their mod cache and check the behavior, they downloaded the artifact referred in sum.golang.org consistently. Let me know if you suspect the problem is on my end. I would appreciate any pointers that would help me track down the issue.

Reproduction:

docker run --rm -ti golang:1.26.5-alpine
/go # mkdir /tmp/test
/go # cd /tmp/test
/tmp/test # go mod init x
go: creating new go.mod: module x
/tmp/test # apk add git
( 1/12) Installing brotli-libs (1.2.0-r1)
( 2/12) Installing c-ares (1.34.8-r0)
( 3/12) Installing libunistring (1.4.2-r0)
( 4/12) Installing libidn2 (2.3.8-r0)
( 5/12) Installing nghttp2-libs (1.69.0-r0)
( 6/12) Installing libpsl (0.21.5-r3)
( 7/12) Installing zstd-libs (1.5.7-r2)
( 8/12) Installing libcurl (8.21.0-r0)
( 9/12) Installing libexpat (2.8.2-r0)
(10/12) Installing pcre2 (10.47-r1)
(11/12) Installing git (2.54.0-r0)
(12/12) Installing git-init-template (2.54.0-r0)
Executing busybox-1.37.0-r31.trigger
OK: 20.6 MiB in 29 packages
/tmp/test # env GOPROXY=direct GONOSUMDB="*" go mod download -json github.com/prometheus/node_exporter@v1.12.1 | grep 
'"Sum"'
	"Sum": "h1:t/CM3q/IRe7bRsm/lgpkuvqk/M0i4/M+3gpL3JMQayI=",
/tmp/test # env GOPROXY=direct GONOSUMDB="*" go mod download -json github.com/prometheus/node_exporter@v1.12.1
{
	"Path": "github.com/prometheus/node_exporter",
	"Version": "v1.12.1",
	"Info": "/go/pkg/mod/cache/download/github.com/prometheus/node_exporter/@v/v1.12.1.info",
	"GoMod": "/go/pkg/mod/cache/download/github.com/prometheus/node_exporter/@v/v1.12.1.mod",
	"Zip": "/go/pkg/mod/cache/download/github.com/prometheus/node_exporter/@v/v1.12.1.zip",
	"Dir": "/go/pkg/mod/github.com/prometheus/node_exporter@v1.12.1",
	"Sum": "h1:t/CM3q/IRe7bRsm/lgpkuvqk/M0i4/M+3gpL3JMQayI=",
	"GoModSum": "h1:/fflK+t4sTJcBQhtxXvLSTNqKTlWHIdbgAmAIPmn0qU=",
	"Origin": {
		"VCS": "git",
		"URL": "https://github.com/prometheus/node_exporter",
		"Hash": "6044da783597cc3b57aef7580ddcdcff58a4ee99",
		"Ref": "refs/tags/v1.12.1"
	}
}

curl https://sum.golang.org/lookup/github.com/prometheus/node_exporter@v1.12.1
57366173
github.com/prometheus/node_exporter v1.12.1 h1:LzcZ6SqJRH2EULBz3Paa1t1uzQaaoo9domuz8FQDkiY=
github.com/prometheus/node_exporter v1.12.1/go.mod h1:/fflK+t4sTJcBQhtxXvLSTNqKTlWHIdbgAmAIPmn0qU=

go.sum database tree
57892388
3jpdxtqjA/q7GSWIwbWUHKpFBppcUkUVANOZm07f+OY=

— sum.golang.org Az3grmiE4+7fjYw5M9256qVKSvQOreLzJJfVylmkJ3jwcliyQHU8YZdoCzM6DiTdvM1sC8YGiAktpJG+FtykmqajNgY=