golang/go · warning

checksum database disabled by GOSUMDB=off

Error message

checksum database disabled by GOSUMDB=off

What it means

This error indicates that the Go checksum database (sum.golang.org) has been explicitly disabled by setting the GOSUMDB environment variable to 'off'. When GOSUMDB=off, Go refuses to contact the checksum database for module verification. This error surfaces when code attempts to use the sumdb client despite the 'off' setting — it returns an empty name and nil client with this error.

Source

Thrown at src/cmd/go/internal/modfetch/sumdb.go:104

	dbErr  error
)

func dbDial() (dbName string, db *sumdb.Client, err error) {
	// $GOSUMDB can be "key" or "key url",
	// and the key can be a full verifier key
	// or a host on our list of known keys.

	// Special case: sum.golang.google.cn
	// is an alias, reachable inside mainland China,
	// for sum.golang.org. If there are more
	// of these we should add a map like knownGOSUMDB.
	gosumdb := cfg.GOSUMDB
	if gosumdb == "sum.golang.google.cn" {
		gosumdb = "sum.golang.org https://sum.golang.google.cn"
	}

	if gosumdb == "off" {
		return "", nil, fmt.Errorf("checksum database disabled by GOSUMDB=off")
	}

	key := strings.Fields(gosumdb)
	if len(key) >= 1 {
		if k := knownGOSUMDB[key[0]]; k != "" {
			key[0] = k
		}
	}
	if len(key) == 0 {
		return "", nil, fmt.Errorf("missing GOSUMDB")
	}
	if len(key) > 2 {
		return "", nil, fmt.Errorf("invalid GOSUMDB: too many fields")
	}
	vkey, err := note.NewVerifier(key[0])
	if err != nil {
		return "", nil, fmt.Errorf("invalid GOSUMDB: %v", err)
	}

View on GitHub (pinned to b6b368adc5)

Solutions

1. If checksum verification is desired, remove GOSUMDB=off: 'go env -u GOSUMDB' to reset to default, or 'go env -w GOSUMDB=sum.golang.org'.
2. For private modules, use GOPRIVATE or GONOSUMDB instead of disabling the checksum database entirely: 'go env -w GOPRIVATE=github.com/myorg/*'.
3. If working in an air-gapped environment, ensure GOFLAGS=-insecure or vendor dependencies with 'go mod vendor' to avoid runtime sumdb lookups.
4. Check inherited environment: 'go env GOSUMDB' to see the current effective value and trace where it was set (shell profile, Dockerfile, CI config).

Example fix

# before
$ go env -w GOSUMDB=off
$ go get example.com/mymodule
# checksum database disabled by GOSUMDB=off

# after: use GOPRIVATE for private modules, keep sumdb on
$ go env -u GOSUMDB
$ go env -w GOPRIVATE=example.com/mymodule/*
$ go get example.com/mymodule

// Check GOSUMDB before running go commands
func validateGOSUMDB() error {
    out, err := exec.Command("go", "env", "GOSUMDB").Output()
    if err != nil { return err }
    val := strings.TrimSpace(string(out))
    if val == "off" {
        return fmt.Errorf("GOSUMDB is off; checksum verification disabled")
    }
    return nil
}

// Detect GOSUMDB=off and warn the user
if strings.Contains(stderr, "checksum database disabled by GOSUMDB=off") {
    // Inform user that checksum verification is disabled
    // Suggest: go env -u GOSUMDB  to re-enable
}

When it happens

Trigger: GOSUMDB is set to 'off' in the environment or go.env configuration. This is a deliberate setting to skip checksum database verification. The error is returned by the function that initializes the sumdb client (used for verifying module checksums against the transparency log).

Common situations: GOSUMDB=off is set intentionally in CI/CD pipelines or air-gapped environments where the checksum database is unreachable. A developer set GOSUMDB=off to bypass a checksum mismatch and forgot to re-enable it. The environment inherits GOSUMDB=off from a Docker image or CI configuration. Private module workflows set GONOSUMDB/GOPRIVATE instead but GOSUMDB=off is accidentally also set.

Related errors

• missing GOSUMDB
• invalid GOSUMDB: %v
• invalid sumdb name (must be host[/path]): %s %+v
• invalid GOSUMDB: too many fields
• invalid GOSUMDB URL: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/5379aa0a1c0359f6. Report an issue: GitHub.