{"record":{"id":"0bf4f36220c45942","repo":"golang/go","slug":"s-s-zip-has-been-modified-v","errorCode":null,"errorMessage":"%s %s: zip has been modified (%v)","messagePattern":"(.+?) (.+?): zip has been modified \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modcmd/verify.go","lineNumber":127,"sourceCode":"\t\tif zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) &&\n\t\t\tdirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {\n\t\t\t// Nothing downloaded yet. Nothing to verify.\n\t\t\treturn nil\n\t\t}\n\t\terrs = append(errs, fmt.Errorf(\"%s %s: missing ziphash: %v\", mod.Path, mod.Version, err))\n\t\treturn errs\n\t}\n\th := string(bytes.TrimSpace(data))\n\n\tif zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) {\n\t\t// ok\n\t} else {\n\t\thZ, err := dirhash.HashZip(zip, dirhash.DefaultHash)\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: %v\", mod.Path, mod.Version, err))\n\t\t\treturn errs\n\t\t} else if hZ != h {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: zip has been modified (%v)\", mod.Path, mod.Version, zip))\n\t\t}\n\t}\n\tif dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {\n\t\t// ok\n\t} else {\n\t\thD, err := dirhash.HashDir(dir, mod.Path+\"@\"+mod.Version, dirhash.DefaultHash)\n\t\tif err != nil {\n\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: %v\", mod.Path, mod.Version, err))\n\t\t\treturn errs\n\t\t}\n\t\tif hD != h {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: dir has been modified (%v)\", mod.Path, mod.Version, dir))\n\t\t}\n\t}\n\treturn errs\n}\n","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modcmd/verify.go#L109-L145","documentation":"Thrown during `go mod verify` when the computed hash of the module's zip file (`hZ`) does not match the stored ziphash (`h`). This is a tamper-detection signal: the zip file in the cache has been modified after download, diverging from its originally recorded hash. The `%v` argument is the zip file path.","triggerScenarios":"Running `go mod verify` where `dirhash.HashZip` succeeds but produces a hash different from the one stored in the `.ziphash` file. This means the zip content was altered post-download.","commonSituations":"Manual editing or replacement of cached zip files; filesystem corruption that altered bytes; third-party tools that modify the cache; supply-chain concerns where the cache was tampered with; rare hash collision (extremely unlikely).","solutions":["If tampering is not expected, clean and re-download: `go clean -modcache && go mod download`","Investigate the security of the build environment if tampering is suspected","Run `go mod verify` in a fresh CI environment to confirm the module source is clean"],"exampleFix":"// before\ngo mod verify  // zip has been modified\n// after\ngo clean -modcache && go mod download && go mod verify","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// If zip tamper detected, re-download from source\nif strings.Contains(err.Error(), \"zip has been modified\") {\n    goCleanModcache()\n    goModDownload()\n    // re-verify\n}","preventionTips":["Never modify files in GOMODCACHE directly","Run `go mod verify` in CI to catch cache tampering","Use checksum database (GOFLAGS=-mod=ver) for supply-chain integrity"],"tags":["go","go-mod","cache","verification","tamper-detection","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}