Repository: go
Issue: cmd/go: checksum mismatch for module containing Git LFS files
Labels: NeedsInvestigation,modules

<!--
Please answer these questions before submitting your issue. Thanks!
For questions please use one of our forums: https://github.com/golang/go/wiki/Questions
-->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.15.2 linux/amd64
</pre>

### Does this issue reproduce with the latest release?

Yes

### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/costela/.cache/go-build"
GOENV="/home/costela/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/costela/go/pkg/mod"
GOOS="linux"
GOPATH="/home/costela/go"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/home/costela/sdk/go1.15.2"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/costela/sdk/go1.15.2/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build342748982=/tmp/go-build -gno-record-gcc-switches"
</pre></details>

### What did you do?

<!--
If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on play.golang.org is best.
-->

I think I might have found data corruption on proxy.golang.org, and it's unfortunately unclear how it relates to the module's content.

First, the "correct" case: the zip file stored in `proxy.golang.org` matches the checksum on `sum.golang.org`, as expected.
```
$ go1.15.2 clean -modcache && go1.15.2 mod download -json github.com/costela/bio-rd@v0.0.99-1598984019
{
	"Path": "github.com/costela/bio-rd",
	"Version": "v0.0.99-1598984019",
	"Info": "/home/costela/go/pkg/mod/cache/download/github.com/costela/bio-rd/@v/v0.0.99-1598984019.info",
	"GoMod": "/home/costela/go/pkg/mod/cache/download/github.com/costela/bio-rd/@v/v0.0.99-1598984019.mod",
	"Zip": "/home/costela/go/pkg/mod/cache/download/github.com/costela/bio-rd/@v/v0.0.99-1598984019.zip",
	"Dir": "/home/costela/go/pkg/mod/github.com/costela/bio-rd@v0.0.99-1598984019",
	"Sum": "h1:/wCyhMn+DmkHkW3mGjGSso+QfpGsZMojhthWjFfptvw=",
	"GoModSum": "h1:Dm2pV+USySIWrQ13pjU0+KxXwiKPGdiigDv2fM+RcDs="
}
```
*NOTE*: this repo was forked and tagged explicitly to debug this issue. The tag is new and hasn't been "moved".

Now we hit the problem with `GOPROXY=direct`:
```
$ go1.15.2 clean -modcache && GOPROXY=direct go1.15.2 mod download -json github.com/costela/bio-rd@v0.0.99-1598984019
{
	"Path": "github.com/costela/bio-rd",
	"Version": "v0.0.99-1598984019",
	"Error": "github.com/costela/bio-rd@v0.0.99-1598984019: verifying module: checksum mismatch\n\tdownloaded: h1:kHzRJEumdz5H8oG53A0iBfTKELjaNSYvv+r9KIJk7p4=\n\tsum.golang.org: h1:/wCyhMn+DmkHkW3mGjGSso+QfpGsZMojhthWjFfptvw=\n\nSECURITY ERROR\nThis download does NOT match the one reported by the checksum server.\nThe bits may have been replaced on the origin server, or an attacker may\nhave intercepted the download attempt.\n\nFor more information, see 'go help module-auth'.\n",
	"Info": "/home/costela/go/pkg/mod/cache/download/github.com/costela/bio-rd/@v/v0.0.99-1598984019.info",
	"GoMod": "/home/costela/go/pkg/mod/cache/download/github.com/costela/bio-rd/@v/v0.0.99-1598984019.mod",
	"GoModSum": "h1:Dm2pV+USySIWrQ13pjU0+KxXwiKPGdiigDv2fM+RcDs="
}
```

If we compare the zip file received from `proxy.golang.org` to the one generated locally as a tempfile when using `GOPROXY=direct`, we notice a discrepancy:
`$ diff -urN <(zipinfo goproxy.zip) <(zipinfo direct.zip)` 
```patch
--- /proc/self/fd/11	2020-09-30 10:44:29.400724671 +0200
+++ /proc/self/fd/13	2020-09-30 10:44:29.396724658 +0200
@@ -1,5 +1,5 @@
-Archive:  goproxy.zip
-Zip file size: 3020773 bytes, number of entries: 403
+Archive:  direct.zip
+Zip file size: 7157287 bytes, number of entries: 403
 -rw----     2.0 fat      107 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/.circleci/build-examples
 -rw----     2.0 fat      226 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/.circleci/check-gofmt
 -rw----     2.0 fat      405 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/.circleci/config.yml
@@ -12,7 +12,7 @@
 -rw----     2.0 fat    11357 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/LICENSE
 -rw----     2.0 fat      860 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/README.md
 -rw----     2.0 fat      473 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/RFCs.md
--rw----     2.0 fat      133 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/benchmarks/bgp/decode_real_full_feed/AS8881.raw
+-rw----     2.0 fat 12282584 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/benchmarks/bgp/decode_real_full_feed/AS8881.raw
 -rw----     2.0 fat     2444 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/benchmarks/bgp/decode_real_full_feed/main.go
 -rw----     2.0 fat     4421 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/benchmarks/bgp/learning/main.go
 -rw----     2.0 fat      967 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/benchmarks/ipcache/main.go
@@ -403,4 +403,4 @@
 -rw----     2.0 fat      836 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/util/net/net_addr_test.go
 -rw----     2.0 fat     4095 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/util/servicewrapper/grpc.go
 -rw----     2.0 fat     1091 bl defN 80-000-00 00:00 github.com/costela/bio-rd@v0.0.99-1598984019/util/time/ticker.go
-403 files, 6622187 bytes uncompressed, 2916799 bytes compressed:  56.0%
+403 files, 18904638 bytes uncompressed, 7053313 bytes compressed:  62.7%
```

It looks like `proxy.golang.org` silently truncated one binary file in the repository, so the checksum in `sum.golang.org` is for this "truncated" version, which doesn't correspond to the actual code in the original repository.

### What did you expect to see?

The checksum seen when downloading with or without `GOPROXY=direct` should be the same.

### What did you see instead?

Checksum mismatch.