golang/go · error

%s %s: zip has been modified (%v)

Error message

%s %s: zip has been modified (%v)

What it means

Thrown during `go mod verify` when the computed hash of the module's zip file (`hZ`) does not match the stored ziphash (`h`). This is a tamper-detection signal: the zip file in the cache has been modified after download, diverging from its originally recorded hash. The `%v` argument is the zip file path.

Source

Thrown at src/cmd/go/internal/modcmd/verify.go:127

		if zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) &&
			dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {
			// Nothing downloaded yet. Nothing to verify.
			return nil
		}
		errs = append(errs, fmt.Errorf("%s %s: missing ziphash: %v", mod.Path, mod.Version, err))
		return errs
	}
	h := string(bytes.TrimSpace(data))

	if zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) {
		// ok
	} else {
		hZ, err := dirhash.HashZip(zip, dirhash.DefaultHash)
		if err != nil {
			errs = append(errs, fmt.Errorf("%s %s: %v", mod.Path, mod.Version, err))
			return errs
		} else if hZ != h {
			errs = append(errs, fmt.Errorf("%s %s: zip has been modified (%v)", mod.Path, mod.Version, zip))
		}
	}
	if dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {
		// ok
	} else {
		hD, err := dirhash.HashDir(dir, mod.Path+"@"+mod.Version, dirhash.DefaultHash)
		if err != nil {

			errs = append(errs, fmt.Errorf("%s %s: %v", mod.Path, mod.Version, err))
			return errs
		}
		if hD != h {
			errs = append(errs, fmt.Errorf("%s %s: dir has been modified (%v)", mod.Path, mod.Version, dir))
		}
	}
	return errs
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. If tampering is not expected, clean and re-download: `go clean -modcache && go mod download`
2. Investigate the security of the build environment if tampering is suspected
3. Run `go mod verify` in a fresh CI environment to confirm the module source is clean

Example fix

// before
go mod verify  // zip has been modified
// after
go clean -modcache && go mod download && go mod verify

// If zip tamper detected, re-download from source
if strings.Contains(err.Error(), "zip has been modified") {
    goCleanModcache()
    goModDownload()
    // re-verify
}

When it happens

Trigger: Running `go mod verify` where `dirhash.HashZip` succeeds but produces a hash different from the one stored in the `.ziphash` file. This means the zip content was altered post-download.

Common situations: Manual editing or replacement of cached zip files; filesystem corruption that altered bytes; third-party tools that modify the cache; supply-chain concerns where the cache was tampered with; rare hash collision (extremely unlikely).

Related errors

• %s %s: dir has been modified (%v)
• %s %s: missing ziphash: %v
• %s %s: %v
• failed to create cache directory: %w
• module cache not found: neither GOMODCACHE nor GOPATH is set

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/0bf4f36220c45942. Report an issue: GitHub.