Query Regarding the shasum generated

[vipinvkmenon]

If I delete a release from github and run the goreleaser against the same tag, the sahsum of the binaries change. For a given tag (whose commit is constant), why do the binaries shasum change. Is there a way to prevent it? or this is the intended behaviour.

Background, I had created a terraform provider unfortunately the release got delete. I tried running the go-releaser against the tag and the terraform registry complained of SHASUM mismatch. When I look at the SHA256SUMS file I can see that the SHASUM for the binaries/zips have changed.

How do the shasum values change? what factors cause the change even though the commit is the same?

[caarlos0]

this should help you: https://goreleaser.com/blog/reproducible-builds/?h=build#reproducible-builds-with-goreleaser

[vipinvkmenon]

The documentation makes a lot of sense and I tried it as well... In order to experiment this is what I tried:

Created a Tag. Created a release on the tag....(as expected Terraform registry automatically polls it gets the latest release)
Deleted the release & tag. Created the same tag again.... (From Terraform throws the error:

Error while installing vipinvkmenon/exampletime-vkvk v0.4.1: checksum list has unexpected SHA-256
│ hash 6c69b59ce3aceab186911874bf183bd751f3dd7df482c2e7596d33dc7a2810b5 (expected
│ eed50e0edef91ea299842706ff564a02298df7ee1324dfa35f506755664779ec)

When I look at the SHASUM file xxxSHA256SUMS
(vkvk_0.4.1_SHA256SUMS)... its changed...

I then tried this:
Created a new tag. Created the release. (terraform Registry picks up the new release)
Deleted the release (not the tag). Ran the go releaser workflow.

• But the SHASUM still changes.

Here is the go releaser configuration ....
Here is the action workflow

[caarlos0]

Which files had the checksum changed?

Most of
The configuration sections allow to set a mod timestamp, you're probably missing that somewhere.

Or, maybe you run go generate, and that's changing some files?

[vipinvkmenon]

BTW... Thanks for your quick reply and support :)

[vipinvkmenon]

the go generate is not explicitly called in the github workflow. Does the goreleaser call it implicitly? Another factor that I removed from the go release configuration is the go mod tidy. The current goreleaser configuration is as follows:

# Visit https://goreleaser.com for documentation on how to customize this
# behavior.
# before:
#   hooks:
#     # this is just an example and not a requirement for provider building/publishing
#     - go mod tidy
builds:
  - env:
      # goreleaser does not work with CGO, it could also complicate
      # usage by users in CI/CD systems like Terraform Cloud where
      # they are unable to install libraries.
      - CGO_ENABLED=0
    mod_timestamp: "{{ .CommitTimestamp }}"
    flags:
      - -trimpath
    ldflags:
      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }}
    goos:
      - freebsd
      - windows
      - linux
      - darwin
    goarch:
      - amd64
      - "386"
      - arm
      - arm64
    ignore:
      - goos: darwin
        goarch: "386"
    binary: "{{ .ProjectName }}_v{{ .Version }}"
archives:
  - format: zip
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
checksum:
  extra_files:
    - glob: "terraform-registry-manifest.json"
      name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
  name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
  algorithm: sha256
signs:
  - artifacts: checksum
    args:
      # if you are using this in a GitHub action or some other automated pipeline, you
      # need to pass the batch flag to indicate its not interactive.
      - "--batch"
      - "--local-user"
      - "{{ .Env.GPG_FINGERPRINT }}" # set this environment variable for your signing key
      - "--output"
      - "${signature}"
      - "--detach-sign"
      - "${artifact}"
release:
  extra_files:
    - glob: "terraform-registry-manifest.json"
      name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
  # If you want to manually examine the release before its live, uncomment this line:
  # draft: true
changelog:
  use: github-native
# gomod:
#   proxy: true

And the workflow file:

As can see it doesn't call anything other than release. As documented, the configuration runs against the latest tag to create the release. If I then delete the release (not tag) and run the workflow again it runs against the same tag as expected, but all the shasums change.

# Terraform Provider release workflow.
name: Release

# This GitHub action creates a release when a tag that matches the pattern
# "v*" (e.g. v0.1.0) is created.
on:
  workflow_dispatch:
  
# Releases need permissions to read and write the repository contents.
# GitHub considers creating releases and uploading assets as writing contents.
permissions:
  contents: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          # Allow goreleaser to access older tag information.
          fetch-depth: 0
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: 'go.mod'
          cache: true
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        id: import_gpg
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
        with:
          args: release --clean --debug --verbose
        env:
          # GitHub sets the GITHUB_TOKEN secret automatically.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

Is there a way to debug the .CommitTimestamp .CommitDate and other build variables?

[caarlos0]

go generate is not called implicitly no

what is that manifest.json file? its added to the archives, that seems like the likely culprit

[vipinvkmenon]

You mean the one the checksum extra-files right?

checksum:
  extra_files:
    - glob: "terraform-registry-manifest.json"
      name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
  name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
  algorithm: sha256

Yea even I have my doubts on that. Deleting it prevents the release from getting pulled into the terraform registry.

The contents of the manifest file is the following.

{
    "version": 1,
    "metadata": {
      "protocol_versions": ["6.0"]
    }
  }

So its basically a static file. Does the glob action factor in the timestamp (Considering it gives a new name based on template) or adding it to the zip modify the checksum?

[caarlos0]

hey, did you manage to figure this out?

i completely missed your last message, sorry