{"record":{"id":"09be3527bb07ca46","repo":"golang/go","slug":"s-s-s-s-s-error-finding-sum-for-s-v","errorCode":null,"errorMessage":"%s %s %s => %s%s: error finding sum for %s: %v","messagePattern":"(.+?) (.+?) (.+?) => (.+?)(.+?): error finding sum for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modget/get.go","lineNumber":1807,"sourceCode":"\t\t}\n\t\toldActual := old\n\t\tif oldRepl := modload.Replacement(ld, old); oldRepl.Path != \"\" {\n\t\t\toldActual = oldRepl\n\t\t}\n\t\tif mActual == oldActual || mActual.Version == \"\" || !modfetch.HaveSum(ld.Fetcher(), oldActual) {\n\t\t\tcontinue\n\t\t}\n\t\tr.work.Add(func() {\n\t\t\tif _, err := ld.Fetcher().DownloadZip(ctx, mActual); err != nil {\n\t\t\t\tverb := \"upgraded\"\n\t\t\t\tif gover.ModCompare(m.Path, m.Version, old.Version) < 0 {\n\t\t\t\t\tverb = \"downgraded\"\n\t\t\t\t}\n\t\t\t\treplaced := \"\"\n\t\t\t\tif mActual != m {\n\t\t\t\t\treplaced = fmt.Sprintf(\" (replaced by %s)\", mActual)\n\t\t\t\t}\n\t\t\t\terr = fmt.Errorf(\"%s %s %s => %s%s: error finding sum for %s: %v\", verb, m.Path, old.Version, m.Version, replaced, mActual, err)\n\t\t\t\tsumErrs[i] = err\n\t\t\t}\n\t\t})\n\t}\n\n\t<-r.work.Idle()\n\n\t// Report deprecations, then retractions, then errors fetching sums.\n\t// Only errors fetching sums are hard errors.\n\tfor _, mm := range deprecations {\n\t\tif mm.message != \"\" {\n\t\t\tfmt.Fprintf(os.Stderr, \"go: module %s is deprecated: %s\\n\", mm.m.Path, mm.message)\n\t\t}\n\t}\n\tvar retractPath string\n\tfor _, mm := range retractions {\n\t\tif mm.message != \"\" {\n\t\t\tfmt.Fprintf(os.Stderr, \"go: warning: %v\\n\", mm.message)","sourceCodeStart":1789,"sourceCodeEnd":1825,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modget/get.go#L1789-L1825","documentation":"This error wraps a checksum verification failure that occurs after a module has been upgraded or downgraded. The code attempts to DownloadZip for the module at its new version (mActual), and if that fails, it formats a comprehensive error showing: the operation (upgraded/downgraded), the module path, the old version, the new version, any replacement, and the underlying error. The 'error finding sum for' phrase indicates the checksum database could not verify the module's integrity.","triggerScenarios":"After go get changes a module's version (upgrade or downgrade), the toolchain downloads the module zip and verifies its checksum against the sumdb (checksum database). If the checksum is not found in the database or verification fails, DownloadZip returns an error that gets wrapped here. This happens in the r.work goroutine during the sum verification phase.","commonSituations":"A module at the new version hasn't been recorded in the checksum database yet (recently published). GOSUMDB=off and the module isn't in go.sum either. A private module not covered by GOPRIVATE/GONOSUMDB. A checksum mismatch indicating the module content was tampered with or the proxy served different bytes. The sumdb is unreachable (network issue) and there's no cached checksum.","solutions":["Clear the module cache and retry: 'go clean -modcache && go mod download'.","For private modules, set GOPRIVATE: 'go env -w GOPRIVATE=example.com/private/*' to bypass sumdb verification.","If the module was recently published, wait for the sumdb to index it (can take minutes to hours).","Temporarily set GOFLAGS=-insecure or GONOSUMDB for the specific module if you trust the source.","Update go.sum manually: 'go mod tidy' may resolve stale checksum entries.","Check if the module is behind a proxy that modifies content: switch GOPROXY or use GOPROXY=direct."],"exampleFix":"# before\n$ go get example.com/mymodule@v1.2.0\n# upgraded example.com/mymodule v1.1.0 => v1.2.0: error finding sum for example.com/mymodule@v1.2.0: ...\n\n# after: mark as private to skip sumdb\n$ go env -w GOPRIVATE=example.com/mymodule\n$ go get example.com/mymodule@v1.2.0\n# or clear cache and retry\n$ go clean -modcache && go get example.com/mymodule@v1.2.0","handlingStrategy":"retry","validationCode":"// Validate checksum availability before committing to a version change\nfunc validateChecksumAvailable(modPath, version string) error {\n    // Try a dry-run download to check if sum is available\n    cmd := exec.Command(\"go\", \"mod\", \"download\", \"-json\", fmt.Sprintf(\"%s@%s\", modPath, version))\n    output, err := cmd.CombinedOutput()\n    if err != nil {\n        if strings.Contains(string(output), \"error finding sum\") {\n            return fmt.Errorf(\"checksum not available for %s@%s; check GOPRIVATE/GONOSUMDB settings\", modPath, version)\n        }\n        return err\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(stderr, \"error finding sum for\") {\n    // Checksum verification failed after version change\n    // Possible actions:\n    // 1. Set GOPRIVATE if it's a private module\n    // 2. Clear module cache: go clean -modcache\n    // 3. Retry (sumdb may have indexed the module since)\n    // 4. Run go mod tidy to reconcile go.sum\n}","preventionTips":["Set GOPRIVATE for private modules to bypass sumdb checks","Run 'go mod download' in a pre-merge CI step to catch checksum issues early","Keep go.sum committed and up to date","Avoid running go get -u blindly; test upgrades incrementally","Wait for newly published modules to propagate to sum.golang.org before depending on them"],"tags":["go-get","go-sumdb","checksum","module-download","network","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}