What causes "invalid GOSUMDB URL: %v" in golang/go?

Provide a well-formed URL with scheme: 'go env -w GOSUMDB="sum.golang.org https://my-sumdb.example.com"'.

invalid GOSUMDB URL: %v

Error message

invalid GOSUMDB URL: %v

What it means

This error occurs when GOSUMDB contains two fields (name and URL), but the second field (the alternate URL for the checksum database) fails to parse as a valid URL. The url.Parse call on key[1] returns an error, meaning the URL component is syntactically malformed.

Source

Thrown at src/cmd/go/internal/modfetch/sumdb.go:138

	if err != nil {
		return "", nil, fmt.Errorf("invalid GOSUMDB: %v", err)
	}
	name := vkey.Name()

	// No funny business in the database name.
	direct, err := url.Parse("https://" + name)
	if err != nil || strings.HasSuffix(name, "/") || *direct != (url.URL{Scheme: "https", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != "" || direct.Host == "" {
		return "", nil, fmt.Errorf("invalid sumdb name (must be host[/path]): %s %+v", name, *direct)
	}

	// Determine how to get to database.
	var base *url.URL
	if len(key) >= 2 {
		// Use explicit alternate URL listed in $GOSUMDB,
		// bypassing both the default URL derivation and any proxies.
		u, err := url.Parse(key[1])
		if err != nil {
			return "", nil, fmt.Errorf("invalid GOSUMDB URL: %v", err)
		}
		base = u
	}

	return name, sumdb.NewClient(&dbClient{key: key[0], name: name, direct: direct, base: base}), nil
}

type dbClient struct {
	key    string
	name   string
	direct *url.URL

	once    sync.Once
	base    *url.URL
	baseErr error
}

func (c *dbClient) ReadRemote(path string) ([]byte, error) {

View on GitHub (pinned to b6b368adc5)

Solutions

Provide a well-formed URL with scheme: 'go env -w GOSUMDB="sum.golang.org https://my-sumdb.example.com"'.
Omit the URL field entirely if you want Go to derive the URL from the name automatically: 'go env -w GOSUMDB=sum.golang.org'.
Verify the URL with 'curl' or a URL parser before setting it.
Reset to default: 'go env -u GOSUMDB'.

Example fix

# before: malformed URL (single slash)
$ go env -w GOSUMDB="sum.golang.org https:/sum.golang.org"
# invalid GOSUMDB URL: ...

# after: proper URL
$ go env -w GOSUMDB="sum.golang.org https://sum.golang.org"
# or omit URL entirely
$ go env -w GOSUMDB=sum.golang.org

Defensive patterns

Strategy: validation

Validate before calling

// Validate GOSUMDB URL field if present
import "net/url"

func validateGOSUMDBURL(gosumdb string) error {
    fields := strings.Fields(gosumdb)
    if len(fields) < 2 { return nil } // no URL field is fine
    _, err := url.Parse(fields[1])
    return err
}

Try / catch

if strings.Contains(stderr, "invalid GOSUMDB URL") {
    // URL component of GOSUMDB is malformed
    // Reset: go env -u GOSUMDB  or go env -w GOSUMDB=sum.golang.org
}

Prevention

If providing a URL in GOSUMDB, ensure it has a valid scheme (https://)
Test the URL with curl before setting it in GOSUMDB
Omit the URL field unless a specific alternate URL is needed

When it happens

Trigger: GOSUMDB is set to 'name url' where url is not parseable by url.Parse. For example, a URL with invalid characters, missing scheme, or malformed authority component.

Common situations: A custom GOSUMDB with a typo in the URL: 'sum.golang.org https:/sum.golang.org' (single slash). A URL with unencoded spaces or special characters. A relative URL that doesn't have a scheme.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/2dfdf349b2e37022. Report an issue: GitHub.