{"record":{"id":"462b87b050d0f497","repo":"golang/go","slug":"invalid-gosumdb-v","errorCode":null,"errorMessage":"invalid GOSUMDB: %v","messagePattern":"invalid GOSUMDB: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modfetch/sumdb.go","lineNumber":121,"sourceCode":"\tif gosumdb == \"off\" {\n\t\treturn \"\", nil, fmt.Errorf(\"checksum database disabled by GOSUMDB=off\")\n\t}\n\n\tkey := strings.Fields(gosumdb)\n\tif len(key) >= 1 {\n\t\tif k := knownGOSUMDB[key[0]]; k != \"\" {\n\t\t\tkey[0] = k\n\t\t}\n\t}\n\tif len(key) == 0 {\n\t\treturn \"\", nil, fmt.Errorf(\"missing GOSUMDB\")\n\t}\n\tif len(key) > 2 {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: too many fields\")\n\t}\n\tvkey, err := note.NewVerifier(key[0])\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: %v\", err)\n\t}\n\tname := vkey.Name()\n\n\t// No funny business in the database name.\n\tdirect, err := url.Parse(\"https://\" + name)\n\tif err != nil || strings.HasSuffix(name, \"/\") || *direct != (url.URL{Scheme: \"https\", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != \"\" || direct.Host == \"\" {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid sumdb name (must be host[/path]): %s %+v\", name, *direct)\n\t}\n\n\t// Determine how to get to database.\n\tvar base *url.URL\n\tif len(key) >= 2 {\n\t\t// Use explicit alternate URL listed in $GOSUMDB,\n\t\t// bypassing both the default URL derivation and any proxies.\n\t\tu, err := url.Parse(key[1])\n\t\tif err != nil {\n\t\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB URL: %v\", err)\n\t\t}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/sumdb.go#L103-L139","documentation":"This error occurs when the first field of GOSUMDB (the checksum database key) fails to parse as a valid note.Verifier key via note.NewVerifier. The Go checksum database uses signed transparency-log entries; the GOSUMDB key must be a valid note verifier key (format: 'name+hash+key'). If the key is malformed, note.NewVerifier returns an error which is wrapped here.","triggerScenarios":"GOSUMDB's first field is neither a known name (sum.golang.org) nor a valid verifier key string. A custom GOSUMDB with a hand-typed or truncated key. A key with incorrect format (missing the +hash+ suffix, wrong encoding).","commonSituations":"A user sets GOSUMDB to a custom checksum database but provides a malformed verifier key. The key was copy-pasted incorrectly (truncated, extra whitespace inside). A custom sumdb deployment uses a non-standard key format. The knownGOSUMDB alias lookup failed because the name doesn't match any known entry.","solutions":["Use the default: 'go env -u GOSUMDB' (resets to sum.golang.org which is a known name).","For a custom sumdb, provide a valid verifier key in the correct format: a note verifier key looks like 'sum.golang.org/AOa...base64key'.","Double-check the key was copied in full without truncation or embedded whitespace.","If you don't need a custom sumdb, just set GOSUMDB=sum.golang.org or unset it entirely."],"exampleFix":"# before: malformed key\n$ go env -w GOSUMDB=\"mydb+invalid\"\n$ go mod download\n# invalid GOSUMDB: invalid verifier key ...\n\n# after: use default\n$ go env -u GOSUMDB\n$ go mod download","handlingStrategy":"validation","validationCode":"// Validate GOSUMDB key is parseable (for custom sumdb)\nimport \"golang.org/x/mod/sumdb/note\"\n\nfunc validateGOSUMDBKey(gosumdb string) error {\n    fields := strings.Fields(gosumdb)\n    if len(fields) == 0 { return fmt.Errorf(\"empty GOSUMDB\") }\n    // If it's a known name, it's valid\n    known := map[string]bool{\"sum.golang.org\": true, \"sum.golang.google.cn\": true}\n    if known[fields[0]] { return nil }\n    // Otherwise try to parse as verifier key\n    _, err := note.NewVerifier(fields[0])\n    return err\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(stderr, \"invalid GOSUMDB:\") && !strings.Contains(stderr, \"too many fields\") {\n    // Key format issue — reset to default\n    // exec.Command(\"go\", \"env\", \"-u\", \"GOSUMDB\")\n}","preventionTips":["Use the default sum.golang.org unless a custom sumdb is truly needed","When providing a custom key, copy it exactly from the sumdb operator","Validate the key with note.NewVerifier before deploying","Avoid hand-typing base64-encoded keys"],"tags":["go-sumdb","gosumdb","configuration","verifier-key","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}