{"record":{"id":"5379aa0a1c0359f6","repo":"golang/go","slug":"checksum-database-disabled-by-gosumdb-off","errorCode":null,"errorMessage":"checksum database disabled by GOSUMDB=off","messagePattern":"checksum database disabled by GOSUMDB=off","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/cmd/go/internal/modfetch/sumdb.go","lineNumber":104,"sourceCode":"\tdbErr  error\n)\n\nfunc dbDial() (dbName string, db *sumdb.Client, err error) {\n\t// $GOSUMDB can be \"key\" or \"key url\",\n\t// and the key can be a full verifier key\n\t// or a host on our list of known keys.\n\n\t// Special case: sum.golang.google.cn\n\t// is an alias, reachable inside mainland China,\n\t// for sum.golang.org. If there are more\n\t// of these we should add a map like knownGOSUMDB.\n\tgosumdb := cfg.GOSUMDB\n\tif gosumdb == \"sum.golang.google.cn\" {\n\t\tgosumdb = \"sum.golang.org https://sum.golang.google.cn\"\n\t}\n\n\tif gosumdb == \"off\" {\n\t\treturn \"\", nil, fmt.Errorf(\"checksum database disabled by GOSUMDB=off\")\n\t}\n\n\tkey := strings.Fields(gosumdb)\n\tif len(key) >= 1 {\n\t\tif k := knownGOSUMDB[key[0]]; k != \"\" {\n\t\t\tkey[0] = k\n\t\t}\n\t}\n\tif len(key) == 0 {\n\t\treturn \"\", nil, fmt.Errorf(\"missing GOSUMDB\")\n\t}\n\tif len(key) > 2 {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: too many fields\")\n\t}\n\tvkey, err := note.NewVerifier(key[0])\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: %v\", err)\n\t}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/sumdb.go#L86-L122","documentation":"This error indicates that the Go checksum database (sum.golang.org) has been explicitly disabled by setting the GOSUMDB environment variable to 'off'. When GOSUMDB=off, Go refuses to contact the checksum database for module verification. This error surfaces when code attempts to use the sumdb client despite the 'off' setting — it returns an empty name and nil client with this error.","triggerScenarios":"GOSUMDB is set to 'off' in the environment or go.env configuration. This is a deliberate setting to skip checksum database verification. The error is returned by the function that initializes the sumdb client (used for verifying module checksums against the transparency log).","commonSituations":"GOSUMDB=off is set intentionally in CI/CD pipelines or air-gapped environments where the checksum database is unreachable. A developer set GOSUMDB=off to bypass a checksum mismatch and forgot to re-enable it. The environment inherits GOSUMDB=off from a Docker image or CI configuration. Private module workflows set GONOSUMDB/GOPRIVATE instead but GOSUMDB=off is accidentally also set.","solutions":["If checksum verification is desired, remove GOSUMDB=off: 'go env -u GOSUMDB' to reset to default, or 'go env -w GOSUMDB=sum.golang.org'.","For private modules, use GOPRIVATE or GONOSUMDB instead of disabling the checksum database entirely: 'go env -w GOPRIVATE=github.com/myorg/*'.","If working in an air-gapped environment, ensure GOFLAGS=-insecure or vendor dependencies with 'go mod vendor' to avoid runtime sumdb lookups.","Check inherited environment: 'go env GOSUMDB' to see the current effective value and trace where it was set (shell profile, Dockerfile, CI config)."],"exampleFix":"# before\n$ go env -w GOSUMDB=off\n$ go get example.com/mymodule\n# checksum database disabled by GOSUMDB=off\n\n# after: use GOPRIVATE for private modules, keep sumdb on\n$ go env -u GOSUMDB\n$ go env -w GOPRIVATE=example.com/mymodule/*\n$ go get example.com/mymodule","handlingStrategy":"validation","validationCode":"// Check GOSUMDB before running go commands\nfunc validateGOSUMDB() error {\n    out, err := exec.Command(\"go\", \"env\", \"GOSUMDB\").Output()\n    if err != nil { return err }\n    val := strings.TrimSpace(string(out))\n    if val == \"off\" {\n        return fmt.Errorf(\"GOSUMDB is off; checksum verification disabled\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Detect GOSUMDB=off and warn the user\nif strings.Contains(stderr, \"checksum database disabled by GOSUMDB=off\") {\n    // Inform user that checksum verification is disabled\n    // Suggest: go env -u GOSUMDB  to re-enable\n}","preventionTips":["Avoid setting GOSUMDB=off globally; use GOPRIVATE for private modules instead","Document in CI configs why GOSUMDB=off is set if it must be","Use go env to audit Go environment configuration regularly","Set GONOSUMDB per-domain rather than disabling the entire sumdb"],"tags":["go-sumdb","gosumdb","configuration","checksum","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}