{"record":{"id":"2dfdf349b2e37022","repo":"golang/go","slug":"invalid-gosumdb-url-v","errorCode":null,"errorMessage":"invalid GOSUMDB URL: %v","messagePattern":"invalid GOSUMDB URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modfetch/sumdb.go","lineNumber":138,"sourceCode":"\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: %v\", err)\n\t}\n\tname := vkey.Name()\n\n\t// No funny business in the database name.\n\tdirect, err := url.Parse(\"https://\" + name)\n\tif err != nil || strings.HasSuffix(name, \"/\") || *direct != (url.URL{Scheme: \"https\", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != \"\" || direct.Host == \"\" {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid sumdb name (must be host[/path]): %s %+v\", name, *direct)\n\t}\n\n\t// Determine how to get to database.\n\tvar base *url.URL\n\tif len(key) >= 2 {\n\t\t// Use explicit alternate URL listed in $GOSUMDB,\n\t\t// bypassing both the default URL derivation and any proxies.\n\t\tu, err := url.Parse(key[1])\n\t\tif err != nil {\n\t\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB URL: %v\", err)\n\t\t}\n\t\tbase = u\n\t}\n\n\treturn name, sumdb.NewClient(&dbClient{key: key[0], name: name, direct: direct, base: base}), nil\n}\n\ntype dbClient struct {\n\tkey    string\n\tname   string\n\tdirect *url.URL\n\n\tonce    sync.Once\n\tbase    *url.URL\n\tbaseErr error\n}\n\nfunc (c *dbClient) ReadRemote(path string) ([]byte, error) {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/sumdb.go#L120-L156","documentation":"This error occurs when GOSUMDB contains two fields (name and URL), but the second field (the alternate URL for the checksum database) fails to parse as a valid URL. The url.Parse call on key[1] returns an error, meaning the URL component is syntactically malformed.","triggerScenarios":"GOSUMDB is set to 'name url' where url is not parseable by url.Parse. For example, a URL with invalid characters, missing scheme, or malformed authority component.","commonSituations":"A custom GOSUMDB with a typo in the URL: 'sum.golang.org https:/sum.golang.org' (single slash). A URL with unencoded spaces or special characters. A relative URL that doesn't have a scheme.","solutions":["Provide a well-formed URL with scheme: 'go env -w GOSUMDB=\"sum.golang.org https://my-sumdb.example.com\"'.","Omit the URL field entirely if you want Go to derive the URL from the name automatically: 'go env -w GOSUMDB=sum.golang.org'.","Verify the URL with 'curl' or a URL parser before setting it.","Reset to default: 'go env -u GOSUMDB'."],"exampleFix":"# before: malformed URL (single slash)\n$ go env -w GOSUMDB=\"sum.golang.org https:/sum.golang.org\"\n# invalid GOSUMDB URL: ...\n\n# after: proper URL\n$ go env -w GOSUMDB=\"sum.golang.org https://sum.golang.org\"\n# or omit URL entirely\n$ go env -w GOSUMDB=sum.golang.org","handlingStrategy":"validation","validationCode":"// Validate GOSUMDB URL field if present\nimport \"net/url\"\n\nfunc validateGOSUMDBURL(gosumdb string) error {\n    fields := strings.Fields(gosumdb)\n    if len(fields) < 2 { return nil } // no URL field is fine\n    _, err := url.Parse(fields[1])\n    return err\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(stderr, \"invalid GOSUMDB URL\") {\n    // URL component of GOSUMDB is malformed\n    // Reset: go env -u GOSUMDB  or go env -w GOSUMDB=sum.golang.org\n}","preventionTips":["If providing a URL in GOSUMDB, ensure it has a valid scheme (https://)","Test the URL with curl before setting it in GOSUMDB","Omit the URL field unless a specific alternate URL is needed"],"tags":["go-sumdb","gosumdb","url-validation","configuration"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}