Comment by skywhopper

But a “version” as listed in go.mod may have different hashes over time, if tags are changed. That’s the issue.