Latest version cached by proxy.golang.org does not match `v0.1.0`

[lsg551]

When I first installed

go get github.com/patent-dev/epo-ops

I expected it to install v0.1.0 – the latest version of two in total of that branch, released two months ago. All immediate logs reported that this version has in fact been installed, go get, go.mod as well as go list -m github.com/patent-dev/epo-ops.

When I tried to implement the Hello World example in the README however, the function signatures exported by the library did not seem to align with the README's description.
Looking at the the actual source code of this module installed in my GOPATH, it suggested that v0.1.0 had NOT been installed, but something different, which looked more like the previous version v0.0.1.

$ ls $(go env GOPATH)/pkg/mod/github.com/patent-dev/epo-ops@v0.1.0
[…]
# manually compared source code between v0.1.0 and v0.0.1

Installing directly from source reports an error, because the checksums of the same version here and the one cached by proxy.golang.org do not align:

$ GOPROXY=direct go get github.com/patent-dev/epo-ops@v0.1.0
go: finding module for package github.com/patent-dev/epo-ops
github.com/patent-dev/epo-ops@v0.1.0: verifying module: checksum mismatch
        downloaded: h1:KXVlFpg1UoM4LFXIuICU9/k0ejvy8tKvqdKu1pwDOQg=
        sum.golang.org: h1:zRdM/kopy8E/lxNPw7kY3R0wWuovqP3S3rrMMWMWaAQ=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

I checked which version proxy.golang.org is actually caching:

$ curl https://proxy.golang.org/github.com/patent-dev/epo-ops/@v/v0.1.0.info
{
  "Version": "v0.1.0",
  "Time": "2025-10-24T23:19:57Z",
  "Origin": {
    "VCS": "git",
    "URL": "https://github.com/patent-dev/epo-ops",
    "Hash": "b2b57407f23f27db9954dfff46a24fdfa408cc67",
    "Ref": "refs/tags/v0.1.0"
  }
}

The output indicates that the module cached version v0.1.0 on 2025-10-24, although the tag ref (v0.1.0) has only been created 5 days later, on 2025-10-29

$ git log
commit 9b8aa45bbb51886a05bd9f61fea350fd51f654e9 (HEAD -> main, tag: v0.1.0, origin/main, origin/HEAD)
Author: Wolfgang Stark <ws@funktionslust.digital>
Date:   Wed Oct 29 16:28:03 2025 +0100

    add additional XML parsing capabilities

commit 7d81aa40a92795953551b6d49bdaea55a2b38344 (tag: v0.0.1)
Author: Wolfgang Stark <ws@funktionslust.digital>
Date:   Sat Oct 25 14:12:38 2025 +0200

    Initial commit

$ git log --tags --simplify-by-decoration --pretty="format:%ci %d"
2025-10-29 16:28:03 +0100  (HEAD -> main, tag: v0.1.0, origin/main, origin/HEAD)
2025-10-25 14:12:38 +0200  (tag: v0.0.1)

Maybe something went wrong along the release process? Has the version been amended?

[lsg551]

At least for me, the issue persists, and I couldn't figure out what has happened. Comparing git refs with the cached versions in Go's proxy reveals mismatches.

Bypassing the default proxy proxy.golang.org and checksum database sum.golang.org via

GOPROXY=direct GOSUMDB=off go get -v github.com/patent-dev/epo-ops@v0.1.0

did not work for me, so for testing, I ended up using the replace directive:

1. Install the module, even though it will likely install the wrong version, as indicated in this issue:

   go get github.com/patent-dev/epo-ops@v0.1.0

2. Clone this repository locally
3. Add this in go.mod:

   replace github.com/patent-dev/epo-ops v0.1.0 => ../epo-ops

   (adjust the relative path if necessary.)
4. Go should use the locally cloned source code with version v0.1.0 instead of the wrong installation in its default cache location