{"record":{"id":"c1417db4c178fc9a","repo":"golang/go","slug":"invalid-sumdb-name-must-be-host-path-s-v","errorCode":null,"errorMessage":"invalid sumdb name (must be host[/path]): %s %+v","messagePattern":"invalid sumdb name \\(must be host\\[/path\\]\\): (.+?) %\\+v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modfetch/sumdb.go","lineNumber":128,"sourceCode":"\t\t\tkey[0] = k\n\t\t}\n\t}\n\tif len(key) == 0 {\n\t\treturn \"\", nil, fmt.Errorf(\"missing GOSUMDB\")\n\t}\n\tif len(key) > 2 {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: too many fields\")\n\t}\n\tvkey, err := note.NewVerifier(key[0])\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB: %v\", err)\n\t}\n\tname := vkey.Name()\n\n\t// No funny business in the database name.\n\tdirect, err := url.Parse(\"https://\" + name)\n\tif err != nil || strings.HasSuffix(name, \"/\") || *direct != (url.URL{Scheme: \"https\", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != \"\" || direct.Host == \"\" {\n\t\treturn \"\", nil, fmt.Errorf(\"invalid sumdb name (must be host[/path]): %s %+v\", name, *direct)\n\t}\n\n\t// Determine how to get to database.\n\tvar base *url.URL\n\tif len(key) >= 2 {\n\t\t// Use explicit alternate URL listed in $GOSUMDB,\n\t\t// bypassing both the default URL derivation and any proxies.\n\t\tu, err := url.Parse(key[1])\n\t\tif err != nil {\n\t\t\treturn \"\", nil, fmt.Errorf(\"invalid GOSUMDB URL: %v\", err)\n\t\t}\n\t\tbase = u\n\t}\n\n\treturn name, sumdb.NewClient(&dbClient{key: key[0], name: name, direct: direct, base: base}), nil\n}\n\ntype dbClient struct {","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/sumdb.go#L110-L146","documentation":"This error validates that the checksum database name extracted from the verifier key is a syntactically clean host[/path] string. It parses 'https://' + name as a URL and checks: no parse error, no trailing slash, the URL round-trips to canonical form, RawPath is empty (no encoding), and Host is non-empty. Any violation means the name has characters that could cause ambiguity in URL construction.","triggerScenarios":"The verifier key's Name component (extracted by vkey.Name()) is something like 'sum.golang.org/some/path/../etc' or contains characters that survive URL parsing but produce non-canonical URLs. A name with a trailing '/', with encoded characters in the path, or with an empty host.","commonSituations":"A custom GOSUMDB verifier key was generated with a name containing special characters. A name with a trailing slash like 'my-sumdb.example.com/'. A name that includes URL-encoding like 'my-sumdb%2Eexample%2Ecom'.","solutions":["Ensure the sumdb name is a plain host or host/path with no URL encoding, no trailing slash, and no special characters.","Use the default sum.golang.org which is known-good.","Regenerate the verifier key with a clean hostname-only name if you control the sumdb.","Reset to default: 'go env -u GOSUMDB'."],"exampleFix":"# before: name has trailing slash\n$ go env -w GOSUMDB=\"my-sumdb.example.com/+hash+key\"\n# invalid sumdb name (must be host[/path])\n\n# after: clean hostname\n$ go env -w GOSUMDB=\"my-sumdb.example.com+hashkey\"\n# or just use default\n$ go env -u GOSUMDB","handlingStrategy":"validation","validationCode":"// Validate sumdb name is a clean host[/path]\nimport \"net/url\"\n\nfunc validateSumdbName(name string) error {\n    if name == \"\" { return fmt.Errorf(\"empty sumdb name\") }\n    if strings.HasSuffix(name, \"/\") { return fmt.Errorf(\"name has trailing slash\") }\n    u, err := url.Parse(\"https://\" + name)\n    if err != nil { return err }\n    if u.Host == \"\" { return fmt.Errorf(\"empty host in name\") }\n    if u.RawPath != \"\" { return fmt.Errorf(\"name contains encoded characters\") }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(stderr, \"invalid sumdb name\") {\n    // Name from verifier key is malformed\n    // Reset: go env -u GOSUMDB\n}","preventionTips":["Use simple hostnames for custom sumdb names (e.g., my-sumdb.example.com)","Avoid trailing slashes, URL encoding, or special characters in the sumdb name","Test custom GOSUMDB settings in an isolated environment before deployment"],"tags":["go-sumdb","gosumdb","url-validation","configuration","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}