golang/go · error

invalid GOSUMDB: too many fields

Error message

invalid GOSUMDB: too many fields

What it means

This error is thrown when the GOSUMDB environment variable contains more than two whitespace-separated fields. The expected format is 'name [URL]' — at most two tokens: a checksum database name/key and an optional alternate URL. A third or subsequent field means the value is malformed.

Source

Thrown at src/cmd/go/internal/modfetch/sumdb.go:117

	if gosumdb == "sum.golang.google.cn" {
		gosumdb = "sum.golang.org https://sum.golang.google.cn"
	}

	if gosumdb == "off" {
		return "", nil, fmt.Errorf("checksum database disabled by GOSUMDB=off")
	}

	key := strings.Fields(gosumdb)
	if len(key) >= 1 {
		if k := knownGOSUMDB[key[0]]; k != "" {
			key[0] = k
		}
	}
	if len(key) == 0 {
		return "", nil, fmt.Errorf("missing GOSUMDB")
	}
	if len(key) > 2 {
		return "", nil, fmt.Errorf("invalid GOSUMDB: too many fields")
	}
	vkey, err := note.NewVerifier(key[0])
	if err != nil {
		return "", nil, fmt.Errorf("invalid GOSUMDB: %v", err)
	}
	name := vkey.Name()

	// No funny business in the database name.
	direct, err := url.Parse("https://" + name)
	if err != nil || strings.HasSuffix(name, "/") || *direct != (url.URL{Scheme: "https", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != "" || direct.Host == "" {
		return "", nil, fmt.Errorf("invalid sumdb name (must be host[/path]): %s %+v", name, *direct)
	}

	// Determine how to get to database.
	var base *url.URL
	if len(key) >= 2 {
		// Use explicit alternate URL listed in $GOSUMDB,
		// bypassing both the default URL derivation and any proxies.

View on GitHub (pinned to b6b368adc5)

Solutions

  1. Set GOSUMDB to the correct two-field-or-fewer format: 'go env -w GOSUMDB=sum.golang.org' (one field) or 'go env -w GOSUMDB="sum.golang.org https://alternate.example.com"' (two fields).
  2. Remove any trailing or extra text after the URL component.
  3. Reset to default: 'go env -u GOSUMDB'.

Example fix

# before
$ go env -w GOSUMDB="sum.golang.org https://sum.golang.org extra-field"
$ go get example.com/mymodule
# invalid GOSUMDB: too many fields

# after: name only (URL is derived automatically)
$ go env -w GOSUMDB=sum.golang.org
$ go get example.com/mymodule
Defensive patterns

Strategy: validation

Validate before calling

// Validate GOSUMDB format: 1 or 2 whitespace-separated fields
func validateGOSUMDBFormat() error {
    out, err := exec.Command("go", "env", "GOSUMDB").Output()
    if err != nil { return err }
    val := strings.TrimSpace(string(out))
    fields := strings.Fields(val)
    if len(fields) > 2 {
        return fmt.Errorf("GOSUMDB has %d fields, expected at most 2", len(fields))
    }
    return nil
}

Try / catch

if strings.Contains(stderr, "invalid GOSUMDB: too many fields") {
    // Reset to default
    // exec.Command("go", "env", "-u", "GOSUMDB")
}

Prevention

When it happens

Trigger: GOSUMDB is set with more than two space-separated components, e.g., 'sum.golang.org https://sum.golang.org extra'. The strings.Fields split produces 3+ elements, triggering the length check.

Common situations: A user accidentally adds extra arguments to GOSUMDB (e.g., adding flags or comments). A copy-paste error includes trailing text. A script concatenates multiple values into GOSUMDB with spaces. Misunderstanding the format as 'name URL key' instead of 'name [URL]'.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/759798c50697d1c6. Report an issue: GitHub.