What causes "invalid sumdb name (must be host[/path]): %s %+v" in golang/go?

Ensure the sumdb name is a plain host or host/path with no URL encoding, no trailing slash, and no special characters.

invalid sumdb name (must be host[/path]): %s %+v

Error message

invalid sumdb name (must be host[/path]): %s %+v

What it means

This error validates that the checksum database name extracted from the verifier key is a syntactically clean host[/path] string. It parses 'https://' + name as a URL and checks: no parse error, no trailing slash, the URL round-trips to canonical form, RawPath is empty (no encoding), and Host is non-empty. Any violation means the name has characters that could cause ambiguity in URL construction.

Source

Thrown at src/cmd/go/internal/modfetch/sumdb.go:128

			key[0] = k
		}
	}
	if len(key) == 0 {
		return "", nil, fmt.Errorf("missing GOSUMDB")
	}
	if len(key) > 2 {
		return "", nil, fmt.Errorf("invalid GOSUMDB: too many fields")
	}
	vkey, err := note.NewVerifier(key[0])
	if err != nil {
		return "", nil, fmt.Errorf("invalid GOSUMDB: %v", err)
	}
	name := vkey.Name()

	// No funny business in the database name.
	direct, err := url.Parse("https://" + name)
	if err != nil || strings.HasSuffix(name, "/") || *direct != (url.URL{Scheme: "https", Host: direct.Host, Path: direct.Path, RawPath: direct.RawPath}) || direct.RawPath != "" || direct.Host == "" {
		return "", nil, fmt.Errorf("invalid sumdb name (must be host[/path]): %s %+v", name, *direct)
	}

	// Determine how to get to database.
	var base *url.URL
	if len(key) >= 2 {
		// Use explicit alternate URL listed in $GOSUMDB,
		// bypassing both the default URL derivation and any proxies.
		u, err := url.Parse(key[1])
		if err != nil {
			return "", nil, fmt.Errorf("invalid GOSUMDB URL: %v", err)
		}
		base = u
	}

	return name, sumdb.NewClient(&dbClient{key: key[0], name: name, direct: direct, base: base}), nil
}

type dbClient struct {

View on GitHub (pinned to b6b368adc5)

Solutions

Ensure the sumdb name is a plain host or host/path with no URL encoding, no trailing slash, and no special characters.
Use the default sum.golang.org which is known-good.
Regenerate the verifier key with a clean hostname-only name if you control the sumdb.
Reset to default: 'go env -u GOSUMDB'.

Example fix

# before: name has trailing slash
$ go env -w GOSUMDB="my-sumdb.example.com/+hash+key"
# invalid sumdb name (must be host[/path])

# after: clean hostname
$ go env -w GOSUMDB="my-sumdb.example.com+hashkey"
# or just use default
$ go env -u GOSUMDB

Defensive patterns

Strategy: validation

Validate before calling

// Validate sumdb name is a clean host[/path]
import "net/url"

func validateSumdbName(name string) error {
    if name == "" { return fmt.Errorf("empty sumdb name") }
    if strings.HasSuffix(name, "/") { return fmt.Errorf("name has trailing slash") }
    u, err := url.Parse("https://" + name)
    if err != nil { return err }
    if u.Host == "" { return fmt.Errorf("empty host in name") }
    if u.RawPath != "" { return fmt.Errorf("name contains encoded characters") }
    return nil
}

Try / catch

if strings.Contains(stderr, "invalid sumdb name") {
    // Name from verifier key is malformed
    // Reset: go env -u GOSUMDB
}

Prevention

Use simple hostnames for custom sumdb names (e.g., my-sumdb.example.com)
Avoid trailing slashes, URL encoding, or special characters in the sumdb name
Test custom GOSUMDB settings in an isolated environment before deployment

When it happens

Trigger: The verifier key's Name component (extracted by vkey.Name()) is something like 'sum.golang.org/some/path/../etc' or contains characters that survive URL parsing but produce non-canonical URLs. A name with a trailing '/', with encoded characters in the path, or with an empty host.

Common situations: A custom GOSUMDB verifier key was generated with a name containing special characters. A name with a trailing slash like 'my-sumdb.example.com/'. A name that includes URL-encoding like 'my-sumdb%2Eexample%2Ecom'.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/c1417db4c178fc9a. Report an issue: GitHub.