{"record":{"id":"489061c4d1429e8d","repo":"golang/go","slug":"verifying-s-checksum-missing-from-sumdb-response","errorCode":null,"errorMessage":"verifying %s: checksum missing from sumdb response\\n\\nSECURITY ERROR\\nThis download does NOT match one reported by the checksum server.\\nThe checksum server has provided checksums, but the checksums do\\nnot contain an entry for the download.\\nThe checksum server may be malfunctioning, or an attacker may have\\nintercepted the checksum request.\\nThe download cannot be verified.\\n\\nFor more information, see 'go help module-auth'.\\n","messagePattern":"verifying (.+?): checksum missing from sumdb response\\\\n\\\\nSECURITY ERROR\\\\nThis download does NOT match one reported by the checksum server\\.\\\\nThe checksum server has provided checksums, but the checksums do\\\\nnot contain an entry for the download\\.\\\\nThe checksum server may be malfunctioning, or an attacker may have\\\\nintercepted the checksum request\\.\\\\nThe download cannot be verified\\.\\\\n\\\\nFor more information, see 'go help module-auth'\\.\\\\n","errorType":"exception","errorClass":"module.VersionError","httpStatus":null,"severity":"critical","filePath":"src/cmd/go/internal/modfetch/fetch.go","lineNumber":873,"sourceCode":"\t\tmodWithoutSuffix.Version = before\n\t}\n\n\tdb, lines, err := lookupSumDB(mod)\n\tif err != nil {\n\t\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: %v\", noun, err))\n\t}\n\n\thave := mod.Path + \" \" + mod.Version + \" \" + h\n\tprefix := mod.Path + \" \" + mod.Version + \" h1:\"\n\tfor _, line := range lines {\n\t\tif line == have {\n\t\t\treturn nil\n\t\t}\n\t\tif strings.HasPrefix(line, prefix) {\n\t\t\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: checksum mismatch\\n\\tdownloaded: %v\\n\\t%s: %v\"+sumdbMismatch, noun, h, db, line[len(prefix)-len(\"h1:\"):]))\n\t\t}\n\t}\n\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: checksum missing from sumdb response\"+sumdbAbsent, noun))\n}\n\n// Sum returns the checksum for the downloaded copy of the given module,\n// if present in the download cache.\nfunc Sum(ctx context.Context, mod module.Version) string {\n\tif cfg.GOMODCACHE == \"\" {\n\t\t// Do not use current directory.\n\t\treturn \"\"\n\t}\n\n\tziphash, err := CachePath(ctx, mod, \"ziphash\")\n\tif err != nil {\n\t\treturn \"\"\n\t}\n\tdata, err := lockedfile.Read(ziphash)\n\tif err != nil {\n\t\treturn \"\"\n\t}","sourceCodeStart":855,"sourceCodeEnd":891,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/fetch.go#L855-L891","documentation":"SECURITY-ERROR path: sumdb returned checksum lines but none of them reference the requested module+version at all. The database responded but omitted the entry, meaning the download cannot be verified — treated as a potential interception or malfunctioning DB.","triggerScenarios":"checkSumDB finishes its loop without any line matching the prefix `path version h1:`. Falls through to the checksum-missing branch with sumdbAbsent.","commonSituations":"Brand-new or yanked version that sum.golang.org has not indexed; private module not in the public DB but not covered by GOPRIVATE/GONOSUMDB; corrupted sumdb mirror; race between upstream publish and sumdb indexing.","solutions":["Add the module path to GOPRIVATE (or GONOSUMDB) so it skips the public sumdb when the module is legitimately private or uncached.","For a public module, wait a few minutes for sum.golang.org to index and retry.","Confirm you are not pointed at a third-party sumdb mirror that is missing entries.","If the version was yanked, pick a different version that the sumdb still records."],"exampleFix":"// before: private module hits public sumdb\n//   GOPRIVATE=\n// after\n//   export GOPRIVATE=corp.example.com/*","handlingStrategy":"validation","validationCode":"// Decide sumdb applicability before invoking go: private/unindexed modules\n// must be in GOPRIVATE to avoid this error.\nfunc shouldSkipSumdb(path, goprivate, gonosumdb string) bool {\n    for _, pat := range strings.Split(goprivate+\",\"+gonosumdb, \",\") {\n        if pat != \"\" && matchPattern(pat, path) { return true }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"// If the version is public but newly published, retry after a short delay to\n// let sum.golang.org index it.\nfor i := 0; i < 5; i++ {\n    if err := modfetch.CheckSumDB(mod, h); err == nil { break } \n    else if !strings.Contains(err.Error(), \"checksum missing\") { return err }\n    time.Sleep(30 * time.Second)\n}","preventionTips":["List every private/internal path in GOPRIVATE.","Wait for sum.golang.org to index freshly published public versions before depending on them in CI.","Validate your GONOSUMDB mirror actually has coverage for the modules you use."],"tags":["checksum","security","sumdb","goprivate"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}