What causes "%s %s: missing ziphash: %v" in golang/go?

Clean and re-download the affected module: `go clean -modcache && go mod download`

%s %s: missing ziphash: %v

Error message

%s %s: missing ziphash: %v

What it means

Thrown during `go mod verify` when the `.ziphash` file for a downloaded module cannot be read, but the module's zip or directory does exist (so it's not simply an undownloaded module). The ziphash file stores the expected hash of the module zip for tamper detection. Its absence with an existing download indicates an incomplete or corrupted cache state.

Source

Thrown at src/cmd/go/internal/modcmd/verify.go:114

		return nil
	}
	if ld.MainModules.Contains(mod.Path) {
		return nil
	}
	var errs []error
	zip, zipErr := modfetch.CachePath(ctx, mod, "zip")
	if zipErr == nil {
		_, zipErr = os.Stat(zip)
	}
	dir, dirErr := modfetch.DownloadDir(ctx, mod)
	data, err := os.ReadFile(zip + "hash")
	if err != nil {
		if zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) &&
			dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {
			// Nothing downloaded yet. Nothing to verify.
			return nil
		}
		errs = append(errs, fmt.Errorf("%s %s: missing ziphash: %v", mod.Path, mod.Version, err))
		return errs
	}
	h := string(bytes.TrimSpace(data))

	if zipErr != nil && errors.Is(zipErr, fs.ErrNotExist) {
		// ok
	} else {
		hZ, err := dirhash.HashZip(zip, dirhash.DefaultHash)
		if err != nil {
			errs = append(errs, fmt.Errorf("%s %s: %v", mod.Path, mod.Version, err))
			return errs
		} else if hZ != h {
			errs = append(errs, fmt.Errorf("%s %s: zip has been modified (%v)", mod.Path, mod.Version, zip))
		}
	}
	if dirErr != nil && errors.Is(dirErr, fs.ErrNotExist) {
		// ok
	} else {

View on GitHub (pinned to b6b368adc5)

Solutions

Clean and re-download the affected module: `go clean -modcache && go mod download`
Run `go clean -cache` then rebuild to regenerate the cache
Check for filesystem corruption or permission issues on GOMODCACHE

Example fix

// before
go mod verify  // fails with missing ziphash
// after
go clean -modcache && go mod download && go mod verify

Defensive patterns

Strategy: retry

Try / catch

// After go mod verify fails with missing ziphash, clean and re-download
if err := runGoModVerify(); err != nil {
    if strings.Contains(err.Error(), "missing ziphash") {
        _ = runGoCleanModcache()
        runGoModDownload()
        err = runGoModVerify()
    }
}

Prevention

Run `go mod verify` after fresh downloads to detect cache issues early
Avoid manually deleting files from GOMODCACHE; use `go clean -modcache`
Ensure downloads complete fully before running verify

When it happens

Trigger: Calling `go mod verify` on a module whose zip/dir exists in GOMODCACHE but whose `.ziphash` file is missing or unreadable. The code checks: if ReadFile(zip+"hash") fails AND both zip and dir exist (zipErr/dirErr are not ErrNotExist), this error fires.

Common situations: Cache corruption from interrupted downloads or manual file deletion; concurrent `go clean -cache` during verify; filesystem issues; older Go versions that didn't write ziphash files; manual tampering with the cache directory.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/be886a5411f0af32. Report an issue: GitHub.