{"record":{"id":"818dcf737fe76874","repo":"golang/go","slug":"s-s-dir-has-been-modified-v","errorCode":null,"errorMessage":"%s %s: dir has been modified (%v)","messagePattern":"(.+?) (.+?): dir has been modified \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modcmd/verify.go","lineNumber":140,"sourceCode":"\t\thZ, err := dirhash.HashZip(zip, dirhash.DefaultHash)\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: %v\", mod.Path, mod.Version, err))\n\t\t\treturn errs\n\t\t} else if hZ != h {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: zip has been modified (%v)\", mod.Path, mod.Version, zip))\n\t\t}\n\t}\n\tif dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {\n\t\t// ok\n\t} else {\n\t\thD, err := dirhash.HashDir(dir, mod.Path+\"@\"+mod.Version, dirhash.DefaultHash)\n\t\tif err != nil {\n\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: %v\", mod.Path, mod.Version, err))\n\t\t\treturn errs\n\t\t}\n\t\tif hD != h {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: dir has been modified (%v)\", mod.Path, mod.Version, dir))\n\t\t}\n\t}\n\treturn errs\n}\n","sourceCodeStart":122,"sourceCodeEnd":145,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modcmd/verify.go#L122-L145","documentation":"Thrown during `go mod verify` when the computed hash of the module's extracted directory (`hD`) does not match the stored ziphash (`h`). This indicates the unpacked module directory has been modified after extraction, diverging from the hash recorded at download time. The `%v` argument is the directory path.","triggerScenarios":"Running `go mod verify` where `dirhash.HashDir` succeeds but `hD != h`. The extracted directory's content differs from what the original zip produced. This is the directory-level counterpart of the zip tamper check.","commonSituations":"Manual editing of cached source files; tools that patch or vendor into the cache; filesystem corruption; accidental modifications from IDE or file managers pointing at GOMODCACHE; partial overwrites.","solutions":["Clean and re-download: `go clean -modcache && go mod download`","Avoid editing files under GOMODCACHE/pkg/mod directly; use vendor directories or replace directives instead","Audit for scripts or tools that write into the module cache"],"exampleFix":"// before\ngo mod verify  // dir has been modified\n// after\ngo clean -modcache && go mod download && go mod verify","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// If directory tamper detected, reset cache\nif strings.Contains(err.Error(), \"dir has been modified\") {\n    goCleanModcache()\n    goModDownload()\n    goModVerify()\n}","preventionTips":["Never edit cached module source files; use replace directives or vendor mode instead","Audit for scripts or tools that write into GOMODCACHE","Run `go mod verify` as part of CI to detect cache modifications"],"tags":["go","go-mod","cache","verification","tamper-detection","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}