Why does go get fail with "invalid version: unknown revision"?

Question

I published an update to a Go module, bumping the version to v1.1.0. I created a tag named v1.1.0 and pushed the tag to GitHub.

https://github.com/depp/bytesize/releases/tag/v1.1.0

However, I cannot use this package in my other projects. I get an error that says, "invalid version: unknown revision v1.1.0". I don't know why the revision is "unknown", since it's tagged.

$ go get github.com/depp/[email protected]                    
go: downloading github.com/depp/bytesize v1.1.0
go get github.com/depp/[email protected]: github.com/depp/[email protected]: verifying module: github.com/depp/[email protected]: reading https://sum.golang.org/lookup/github.com/depp/[email protected]: 410 Gone
    server response: not found: github.com/depp/[email protected]: invalid version: unknown revision v1.1.0
[Exit: 1]

Answer 1

The tag was pushed after invoking go get once, which poisoned the Go module proxy cache.

From https://proxy.golang.org/:

Note that if someone requested the version before the tag was pushed, it may take up to 30 minutes for the mirror's cache to expire and fresh data about the version to become available.

The way to work around this before the cache expires is to use the GOPRIVATE environment variable to instruct go get to fetch this module directly, bypassing the cache.

From https://golang.org/cmd/go/:

GOPRIVATE, GONOPROXY, GONOSUMDB

Comma-separated list of glob patterns (in the syntax of Go's path.Match) of module path prefixes that should always be fetched directly or that should not be compared against the checksum database.

The workaround is:

$ GOPRIVATE=github.com/depp/bytesize go get github.com/depp/[email protected]

Note that if you are already using GOPRIVATE, you will want to add modules rather than overriding the value completely.

Answer 2

Try with:

export GOSUMDB=off

It also works for me for the error:

verifying module: invalid GOSUMDB: malformed verifier id