{"record":{"id":"be886a5411f0af32","repo":"golang/go","slug":"s-s-missing-ziphash-v","errorCode":null,"errorMessage":"%s %s: missing ziphash: %v","messagePattern":"(.+?) (.+?): missing ziphash: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modcmd/verify.go","lineNumber":114,"sourceCode":"\t\treturn nil\n\t}\n\tif ld.MainModules.Contains(mod.Path) {\n\t\treturn nil\n\t}\n\tvar errs []error\n\tzip, zipErr := modfetch.CachePath(ctx, mod, \"zip\")\n\tif zipErr == nil {\n\t\t_, zipErr = os.Stat(zip)\n\t}\n\tdir, dirErr := modfetch.DownloadDir(ctx, mod)\n\tdata, err := os.ReadFile(zip + \"hash\")\n\tif err != nil {\n\t\tif zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) &&\n\t\t\tdirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {\n\t\t\t// Nothing downloaded yet. Nothing to verify.\n\t\t\treturn nil\n\t\t}\n\t\terrs = append(errs, fmt.Errorf(\"%s %s: missing ziphash: %v\", mod.Path, mod.Version, err))\n\t\treturn errs\n\t}\n\th := string(bytes.TrimSpace(data))\n\n\tif zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) {\n\t\t// ok\n\t} else {\n\t\thZ, err := dirhash.HashZip(zip, dirhash.DefaultHash)\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: %v\", mod.Path, mod.Version, err))\n\t\t\treturn errs\n\t\t} else if hZ != h {\n\t\t\terrs = append(errs, fmt.Errorf(\"%s %s: zip has been modified (%v)\", mod.Path, mod.Version, zip))\n\t\t}\n\t}\n\tif dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {\n\t\t// ok\n\t} else {","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modcmd/verify.go#L96-L132","documentation":"Thrown during `go mod verify` when the `.ziphash` file for a downloaded module cannot be read, but the module's zip or directory does exist (so it's not simply an undownloaded module). The ziphash file stores the expected hash of the module zip for tamper detection. Its absence with an existing download indicates an incomplete or corrupted cache state.","triggerScenarios":"Calling `go mod verify` on a module whose zip/dir exists in GOMODCACHE but whose `.ziphash` file is missing or unreadable. The code checks: if ReadFile(zip+\"hash\") fails AND both zip and dir exist (zipErr/dirErr are not ErrNotExist), this error fires.","commonSituations":"Cache corruption from interrupted downloads or manual file deletion; concurrent `go clean -cache` during verify; filesystem issues; older Go versions that didn't write ziphash files; manual tampering with the cache directory.","solutions":["Clean and re-download the affected module: `go clean -modcache && go mod download`","Run `go clean -cache` then rebuild to regenerate the cache","Check for filesystem corruption or permission issues on GOMODCACHE"],"exampleFix":"// before\ngo mod verify  // fails with missing ziphash\n// after\ngo clean -modcache && go mod download && go mod verify","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// After go mod verify fails with missing ziphash, clean and re-download\nif err := runGoModVerify(); err != nil {\n    if strings.Contains(err.Error(), \"missing ziphash\") {\n        _ = runGoCleanModcache()\n        runGoModDownload()\n        err = runGoModVerify()\n    }\n}","preventionTips":["Run `go mod verify` after fresh downloads to detect cache issues early","Avoid manually deleting files from GOMODCACHE; use `go clean -modcache`","Ensure downloads complete fully before running verify"],"tags":["go","go-mod","cache","verification","filesystem"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}