hash_sha256_verify check failing on golangci-lint-2.12.0-darwin-amd64.tar.gz

[Sk8rMarc]

% curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .
golangci/golangci-lint info checking GitHub for latest tag
golangci/golangci-lint info found version: 2.12.0 for v2.12.0/darwin/amd64
golangci/golangci-lint err hash_sha256_verify checksum for '/var/folders/0d/8r9jqxd54rx2l7n0vqv2f0qm0000gn/T/tmp.osJ0JFozaV/golangci-lint-2.12.0-darwin-amd64.tar.gz' did not verify ee171dcdf0865a918c261324f6c2ccf48e3d820559c17a61835834e4ffc9144c
e61afa36dc6378b48dfc7d247297d9694124b5e35540ff9b8e7206583f9f8e7d vs ee171dcdf0865a918c261324f6c2ccf48e3d820559c17a61835834e4ffc9144c

[ldez]

first, note that the branch master is not used anymore, we are using main.

Also we recommend using https://golangci-lint.run/install.sh

https://golangci-lint.run/docs/welcome/install/local/#binaries

But the problem is here is all cases, I will investigate.

[Sk8rMarc]

Looks like the tarball downloaded has sha256sum matching the checksum, but the install script is getting something else.

[ldez]

I think this is related to SBOM files, I'm investigating the problem.

ee171dcdf0865a918c261324f6c2ccf48e3d820559c17a61835834e4ffc9144c  golangci-lint-2.12.0-darwin-amd64.tar.gz
e61afa36dc6378b48dfc7d247297d9694124b5e35540ff9b8e7206583f9f8e7d  golangci-lint-2.12.0-darwin-amd64.tar.gz.sbom.json

[ldez]

I found the problem, and I have a fix

[ldez]

The problem is fixed (on main), so update your script usage to use https://golangci-lint.run/install.sh (recommended) or the main branch.

curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b .

[mannreis]

The unmaintained master branch is still showing this issue. Would it be a good idea to finally deprecate it by redirecting to the main one instead? Or fail loudly instead, displaying the recommended way to install? Thanks!