Checksum error on download of package with symlinks

[calmh]

Describe the bug

In go 1.11.{34} the handling of packages with symlinks in them changed - they are now not included in zip files, previously they were. This means such zip files nowadays get a different checksum, when generated by Go 1.11.4. Zip files generated by Athens 0.2.0 fail this new checksum (assuming the go.sum was created outside of an Athens env).

Error Message

go: downloading github.com/prometheus/procfs v0.0.0-20171226183907-b15cd069a834
go: verifying github.com/prometheus/[email protected]: checksum mismatch
	downloaded: h1:jQVavQNtg1+b1/lxzhVA1JS3NYnCTo4b5Mo6z1N6apo=
	go.sum:     h1:HRxr4uZnx/S86wVQsfXcKhadpzdceXn2qCzCtagcI6w=
exit status 1

To Reproduce

1. "go get" a package with symlinks using Go 1.11.4 and no Athens proxy, so it gets added to go.sum
2. Remove the mod cache, set GOPROXY to point at Athens
3. Go build.

Expected behavior

Zip file with identical checksum to when not using proxy.

Environment (please complete the following information):

gomods/athens:v0.2.0 docker image with disk storage

Additional context

This is an annoying issue that I think shouldn't have suddenly been included in a point release of Go even if the previously generated zip files were erroneous... But we are all early adopters. :)

Related issues:
golang/go#29278 (comment)
golang/go#29191
golang/go#27093

[calmh]

Looking closer at the mechanics I see that this is delegated to the go tool, and that a newer go tool would solve it. The canary docker image works. 👍 All good.