rsc.io/badsum@v1.0.1 This module would match the hard-coded hash for rsc.io/badsum v1.0.1/go.mod in modfetch/notary.go if not for the "break hash" line. -- .mod -- module "rsc.io/badsum" # break hash -- .info -- {"Version":"v1.0.1","Time":"2018-02-14T00:45:20Z"} -- go.mod -- module "rsc.io/badsum" -- badsum.go -- package badsum