{"record":{"id":"dbfc6f6989bf545f","repo":"golang/go","slug":"verifying-s-checksum-mismatch-n-tdownloaded-v","errorCode":null,"errorMessage":"verifying %s: checksum mismatch\\n\\tdownloaded: %v\\n\\t%s: %v\\n\\nSECURITY ERROR\\nThis download does NOT match the one reported by the checksum server.\\nThe bits may have been replaced on the origin server, or an attacker may\\nhave intercepted the download attempt.\\n\\nFor more information, see 'go help module-auth'.\\n","messagePattern":"verifying (.+?): checksum mismatch\\\\n\\\\tdownloaded: (.+?)\\\\n\\\\t(.+?): (.+?)\\\\n\\\\nSECURITY ERROR\\\\nThis download does NOT match the one reported by the checksum server\\.\\\\nThe bits may have been replaced on the origin server, or an attacker may\\\\nhave intercepted the download attempt\\.\\\\n\\\\nFor more information, see 'go help module-auth'\\.\\\\n","errorType":"exception","errorClass":"module.VersionError","httpStatus":null,"severity":"critical","filePath":"src/cmd/go/internal/modfetch/fetch.go","lineNumber":870,"sourceCode":"\tnoun := \"module\"\n\tif before, found := strings.CutSuffix(mod.Version, \"/go.mod\"); found {\n\t\tnoun = \"go.mod\"\n\t\tmodWithoutSuffix.Version = before\n\t}\n\n\tdb, lines, err := lookupSumDB(mod)\n\tif err != nil {\n\t\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: %v\", noun, err))\n\t}\n\n\thave := mod.Path + \" \" + mod.Version + \" \" + h\n\tprefix := mod.Path + \" \" + mod.Version + \" h1:\"\n\tfor _, line := range lines {\n\t\tif line == have {\n\t\t\treturn nil\n\t\t}\n\t\tif strings.HasPrefix(line, prefix) {\n\t\t\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: checksum mismatch\\n\\tdownloaded: %v\\n\\t%s: %v\"+sumdbMismatch, noun, h, db, line[len(prefix)-len(\"h1:\"):]))\n\t\t}\n\t}\n\treturn module.VersionError(modWithoutSuffix, fmt.Errorf(\"verifying %s: checksum missing from sumdb response\"+sumdbAbsent, noun))\n}\n\n// Sum returns the checksum for the downloaded copy of the given module,\n// if present in the download cache.\nfunc Sum(ctx context.Context, mod module.Version) string {\n\tif cfg.GOMODCACHE == \"\" {\n\t\t// Do not use current directory.\n\t\treturn \"\"\n\t}\n\n\tziphash, err := CachePath(ctx, mod, \"ziphash\")\n\tif err != nil {\n\t\treturn \"\"\n\t}\n\tdata, err := lockedfile.Read(ziphash)","sourceCodeStart":852,"sourceCodeEnd":888,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/fetch.go#L852-L888","documentation":"SECURITY-ERROR path: sumdb returned a line for the requested module+version but its hash differs from the locally computed h1 hash. The full message spells out that bits may have been replaced on the origin server or an attacker intercepted the download. The download is rejected outright.","triggerScenarios":"checkSumDB iterates lines; one matches the prefix `path version h1:` but its hash differs from local. module.VersionError is returned with the formatted mismatch including the sumdbMismatch SECURITY ERROR block.","commonSituations":"A compromised or misconfigured module proxy returning tampered content; an upstream tag that was force-pushed after sum.golang.org recorded it; a corporate caching proxy serving stale/corrupt bytes; build-machine clock skew combined with caching middleware.","solutions":["Do NOT bypass: investigate which proxy served the bytes (GOPROXY, GONOPROXY).","Clear the local modcache so a fresh download occurs: go clean -modcache.","Force download direct from VCS via GOPROXY=direct for the affected module to compare.","If upstream retagged legitimately, wait for sum.golang.org to update or pin a different version; never use GONOSUMDB to suppress this signal."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Do NOT catch-and-ignore. Treat as fatal, then quarantine the module and\n// fetch directly from VCS to triage.\nif err := modfetch.Download(...); err != nil {\n    if strings.Contains(err.Error(), \"SECURITY ERROR\") {\n        // alert; pin a known-good version; never bypass with GONOSUMDB\n        panic(err)\n    }\n}","preventionTips":["Never use GONOSUMDB/GONOSUMCHECK to silence this — it indicates tampering.","Pin module versions explicitly in go.mod so a retagged upstream is visible.","Prefer HTTPS proxies you control and audit proxy logs for unexpected retagging."],"tags":["checksum","security","tampering","sumdb"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}