{"record":{"id":"c73c90e2339f2c6c","repo":"golang/go","slug":"verifying-v","errorCode":null,"errorMessage":"verifying %v","messagePattern":"verifying (.+?)","errorType":"console","errorClass":"base.Fatalf","httpStatus":null,"severity":"critical","filePath":"src/cmd/go/internal/modfetch/fetch.go","lineNumber":728,"sourceCode":"\tif err != nil {\n\t\tbase.Fatalf(\"verifying %v\", module.VersionError(mod, err))\n\t}\n\tdata = bytes.TrimSpace(data)\n\tif !isValidSum(data) {\n\t\t// Recreate ziphash file from zip file and use that to check the mod sum.\n\t\tzip, err := CachePath(ctx, mod, \"zip\")\n\t\tif err != nil {\n\t\t\tbase.Fatalf(\"verifying %v\", module.VersionError(mod, err))\n\t\t}\n\t\terr = hashZip(f, mod, zip, ziphash)\n\t\tif err != nil {\n\t\t\tbase.Fatalf(\"verifying %v\", module.VersionError(mod, err))\n\t\t}\n\t\treturn\n\t}\n\th := string(data)\n\tif !strings.HasPrefix(h, \"h1:\") {\n\t\tbase.Fatalf(\"verifying %v\", module.VersionError(mod, fmt.Errorf(\"unexpected ziphash: %q\", h)))\n\t}\n\n\tif err := checkModSum(f, mod, h); err != nil {\n\t\tbase.Fatalf(\"%s\", err)\n\t}\n}\n\n// goModSum returns the checksum for the go.mod contents.\nfunc goModSum(data []byte) (string, error) {\n\treturn dirhash.Hash1([]string{\"go.mod\"}, func(string) (io.ReadCloser, error) {\n\t\treturn io.NopCloser(bytes.NewReader(data)), nil\n\t})\n}\n\n// checkGoMod checks the given module's go.mod checksum;\n// data is the go.mod content.\nfunc checkGoMod(f *Fetcher, path, version string, data []byte) error {\n\th, err := goModSum(data)","sourceCodeStart":710,"sourceCodeEnd":746,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/fetch.go#L710-L746","documentation":"Reached during verification of a module's zip hash (the `-mod=mod` download / go mod verify path). The block calls base.Fatalf — which terminates the process — when hashZip fails or when the recorded ziphash lacks the required 'h1:' algorithm prefix. This is a fatal exit, not a returned error.","triggerScenarios":"CachePath for the zip fails, hashZip returns an error computing the directory hash, or the stored ziphash file content does not start with 'h1:'. base.Fatalf prints the message and os.Exit(2).","commonSituations":"Corrupted or truncated ziphash file in GOMODCACHE; partial download left a half-written hash; disk error during hashing; cache populated by an incompatible go version.","solutions":["Run go clean -modcache and re-download the offending module.","Check the filesystem for the cache directory: full disk, permission errors, or bit-rot.","Ensure only one Go toolchain version writes to the shared GOMODCACHE."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before invoking any command that triggers verification, sanity-check the\n// ziphash file format.\nfunc ziphashLooksValid(p string) error {\n    b, err := os.ReadFile(p)\n    if err != nil { return err }\n    if !strings.HasPrefix(string(b), \"h1:\") {\n        return fmt.Errorf(\"ziphash %s missing h1: prefix\", p)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// base.Fatalf exits the process; there is no catch. Validate inputs first and\n// run verification in a sandboxed subprocess so an abort does not take down\n// the parent.\nout, err := exec.Command(\"go\", \"mod\", \"verify\").CombinedOutput()\nif err != nil { /* handle fatal verification abort */ }","preventionTips":["Run `go mod verify` before builds in CI to surface corruption deterministically.","Keep GOMODCACHE on a reliable local filesystem.","Avoid sharing modcache across Go toolchain major versions."],"tags":["checksum","ziphash","fatal","security","modcache"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}