golang/go · error · module.ModuleError

verifying go.mod: %v

Error message

verifying go.mod: %v

What it means

checkGoMod computes the h1 hash of the go.mod bytes via goModSum and, if hashing itself fails, wraps the underlying error as a ModuleError with 'verifying go.mod:'. This is a wrapping of an unexpected hashing/IO failure, not a checksum mismatch (mismatch surfaces via checkModSum downstream).

Source

Thrown at src/cmd/go/internal/modfetch/fetch.go:748

	if err := checkModSum(f, mod, h); err != nil {
		base.Fatalf("%s", err)
	}
}

// goModSum returns the checksum for the go.mod contents.
func goModSum(data []byte) (string, error) {
	return dirhash.Hash1([]string{"go.mod"}, func(string) (io.ReadCloser, error) {
		return io.NopCloser(bytes.NewReader(data)), nil
	})
}

// checkGoMod checks the given module's go.mod checksum;
// data is the go.mod content.
func checkGoMod(f *Fetcher, path, version string, data []byte) error {
	h, err := goModSum(data)
	if err != nil {
		return &module.ModuleError{Path: path, Version: version, Err: fmt.Errorf("verifying go.mod: %v", err)}
	}

	return checkModSum(f, module.Version{Path: path, Version: version + "/go.mod"}, h)
}

// checkModSum checks that the recorded checksum for mod is h.
//
// mod.Version may have the additional suffix "/go.mod" to request the checksum
// for the module's go.mod file only.
func checkModSum(f *Fetcher, mod module.Version, h string) error {
	// We lock goSum when manipulating it,
	// but we arrange to release the lock when calling checkSumDB,
	// so that parallel calls to checkModHash can execute parallel calls
	// to checkSumDB.

	// Check whether mod+h is listed in go.sum already. If so, we're done.
	f.mu.Lock()
	inited, err := f.initGoSum()

View on GitHub (pinned to b6b368adc5)

Solutions

1. Re-run the command — transient memory/IO pressure may clear it.
2. Clear go.sum and modcache for the module and retry cleanly.
3. File an issue with the full go.mod content if it reproduces, since hash failures here are not user-driven.

if err := modfetch.CheckGoMod(...); err != nil {
    var me *module.ModuleError
    if errors.As(err, &me) {
        // log and retry once; this path usually reflects transient hashing failures
    }
}

When it happens

Trigger: dirhash.Hash1 returns an error while reading the go.mod content — e.g. the function passed to Hash1 returned an error, which for goModSum only happens on an internal allocation/IO failure.

Common situations: Extremely rare in practice; seen with OOM during hashing or a corrupted in-memory copy after a partial read. Usually indicates a bug in surrounding glue rather than user input.

Related errors

• %s %s: %v
• bad checksum
• ziphash file is missing
• ${GoModToolVersion} is required for tool directives in go.mo
• updates to go.mod needed, but go.mod is part of the overlay

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/d19b0aa2b350de35. Report an issue: GitHub.