Plugin integrity check failed for github.com/sablierapp/sablier-traefik-plugin v1.3.1

[acouvreur]

Duplicate of traefik/piceus#158

Hi,

I maintain github.com/sablierapp/sablier-traefik-plugin (catalog page). v1.3.1 downloads fine but fails the integrity check, while v1.3.0 installs with the same setup. It looks like the same stored-hash mismatch as #156 / traefik/traefik#13771.

Error (Traefik v3.7.13)

Plugins are disabled because an error has occurred. error="unable to set up plugins environment: unable to install plugin sablier: unable to check archive integrity of the plugin github.com/sablierapp/sablier-traefik-plugin: plugin integrity check failed" plugins=["sablier"]

Reported by a user in sablierapp/sablier-traefik-plugin#63.

What I checked (2026-09-21)

Version	sha256 of /public/download archive	sha256 of proxy.golang.org zip	/public/validate with that hash
v1.3.0	54ce8184327479aae94c0f9129654c642aff38d1cc5c00f940f099a050188abb	same	200
v1.3.1	c819d45f0239c8ce552f877eded3fbaed93076405077818d7072120d02de7e2a	6f33a87097c57652f545e5220e3fc463322edd8f674bbd33bf719301df4321b5	404

• The v1.3.1 archive you serve and the proxy.golang.org zip have identical contents (44 files) but different bytes, just like badger in #156.
• The archive served for v1.3.1 is stable: repeated downloads, cached and cache-busted, return the same sha256.
• Validate still returns 404 with a cache-busting query string, so the 404 comes from the origin, not the CDN.
• The catalog lists v1.3.1 (latestVersion: v1.3.1), and the tag has not moved since release: v1.3.1 → 4066e63fb05600dd752c5c1959e43244daf1a6a9, the same commit proxy.golang.org reports.
• The plugin analyzer opened no issue on the repository, and v1.3.1 loads fine as a local plugin in Traefik v3.7.13.
• Pinning experimental.plugins.sablier.hash=c819d45f0239c8ce552f877eded3fbaed93076405077818d7072120d02de7e2a makes Traefik v3.7.13 install v1.3.1.

Reproduce

M=github.com/sablierapp/sablier-traefik-plugin
for v in v1.3.0 v1.3.1; do
  curl -sS -o $v.zip "https://plugins.traefik.io/public/download/$M/$v?nocache=$RANDOM"
  H=$(shasum -a 256 $v.zip | cut -d' ' -f1)
  echo "$v $H validate=$(curl -sS -o /dev/null -w '%{http_code}' -H "X-Plugin-Hash: $H" "https://plugins.traefik.io/public/validate/$M/$v?nocache=$RANDOM")"
done

Could you check the stored hash for v1.3.1? Thanks!