Hi,

First off, I want to make clear that I'm largely ignorant about how the particular go modules used during the build are decided upon (I mean, the standard ones - I know about specifying additional stuff with the "--with" flag). Also, I'm not sure if the module I'm having the problem with is actually "a standard one" or maybe it's something that's brought in *by* the one and only thing I specify with the "--with" option (that being github.com/aksdb/caddy-cgi/v2). So, I'm not entirely sure that this is the appropriate place for this bug report. My apologies if not. With that said:

After a recent update to xcaddy (like, 2-3 days ago?), I've been getting a problem during build. Something does in fact build, but the log has the following "security error":

====================
go: caddy imports
        github.com/caddyserver/caddy/v2/modules/standard imports
        github.com/caddyserver/caddy/v2/modules/caddypki/acmeserver imports
        github.com/smallstep/certificates/acme imports
        github.com/smallstep/go-attestation/attest tested by
        github.com/smallstep/go-attestation/attest.test imports
        github.com/google/go-tpm-tools/simulator: github.com/google/go-tpm-tools@v0.4.8: verifying module: checksum mismatch
        downloaded: h1:q8LRQwaO79qVNywF/Hu38aI/+xRjAOPAp0CnMYU7Sro=
        sum.golang.org: h1:V4oIYyAD3BykOycwYQzO29WefDouQMTsYZqmG3HxOfM=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
====================

I poked around the web about it, and based on the little I found that I understood, wound up opening an issue on the github repository for go-tpm-tools:

https://github.com/google/go-tpm-tools/issues/827

I mentioned that one of the things I had found was that this sort of thing might happen if the release had been retagged. One of the developers responded that that might have actually happened, and they released a new version (0.4.9) to resolve the issue.

Unfortunately, when I try to build xcaddy again, I just get the same error, which still says it's happening on the old version of the module (0.4.8). I've tried deleting the module cache, but still the same thing happens: It still pulls 0.4.8, which still results in the error.

Is it necessary to do something in www/xcaddy to update to the new version of go-tpm-tools?

Thanks in advance.