Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Plugin integrity check failed for github.com/sablierapp/sablier-traefik-plugin v1.3.1

Open
  • Is something wrong?
#82 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
go
Domain
backend

Research direction

Start with the plugin-service handling behind /public/download and /public/validate, then reproduce the v1.3.0 and v1.3.1 hash comparison using the shell commands in the issue. Check how the stored hash is selected for a plugin version and verify that validation accepts the archive hash for v1.3.1 without affecting v1.3.0.

Written by the indexing model from the issue text.

Description

Duplicate of https://github.com/traefik/piceus/issues/158

Hi,

I maintain github.com/sablierapp/sablier-traefik-plugin (catalog page). v1.3.1 downloads fine but fails the integrity check, while v1.3.0 installs with the same setup. It looks like the same stored-hash mismatch as #156 / traefik/traefik#13771.

Error (Traefik v3.7.13)
Plugins are disabled because an error has occurred. error="unable to set up plugins environment: unable to install plugin sablier: unable to check archive integrity of the plugin github.com/sablierapp/sablier-traefik-plugin: plugin integrity check failed" plugins=["sablier"]

Reported by a user in sablierapp/sablier-traefik-plugin#63.

What I checked (2026-09-21)
Version sha256 of /public/download archive sha256 of proxy.golang.org zip /public/validate with that hash
v1.3.0 54ce8184327479aae94c0f9129654c642aff38d1cc5c00f940f099a050188abb same 200
v1.3.1 c819d45f0239c8ce552f877eded3fbaed93076405077818d7072120d02de7e2a 6f33a87097c57652f545e5220e3fc463322edd8f674bbd33bf719301df4321b5 404
  • The v1.3.1 archive you serve and the proxy.golang.org zip have identical contents (44 files) but different bytes, just like badger in #156.
  • The archive served for v1.3.1 is stable: repeated downloads, cached and cache-busted, return the same sha256.
  • Validate still returns 404 with a cache-busting query string, so the 404 comes from the origin, not the CDN.
  • The catalog lists v1.3.1 (latestVersion: v1.3.1), and the tag has not moved since release: v1.3.1 → 4066e63fb05600dd752c5c1959e43244daf1a6a9, the same commit proxy.golang.org reports.
  • The plugin analyzer opened no issue on the repository, and v1.3.1 loads fine as a local plugin in Traefik v3.7.13.
  • Pinning experimental.plugins.sablier.hash=c819d45f0239c8ce552f877eded3fbaed93076405077818d7072120d02de7e2a makes Traefik v3.7.13 install v1.3.1.
Reproduce
M=github.com/sablierapp/sablier-traefik-plugin
for v in v1.3.0 v1.3.1; do
  curl -sS -o $v.zip "https://plugins.traefik.io/public/download/$M/$v?nocache=$RANDOM"
  H=$(shasum -a 256 $v.zip | cut -d' ' -f1)
  echo "$v $H validate=$(curl -sS -o /dev/null -w '%{http_code}' -H "X-Plugin-Hash: $H" "https://plugins.traefik.io/public/validate/$M/$v?nocache=$RANDOM")"
done

Could you check the stored hash for v1.3.1? Thanks!

Dominant language
Go
Stars
5
Forks
9
Avg merge
11d 16h
Merged PRs (30d)
1

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from traefik/plugin-service

All issues in traefik/plugin-service

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.