golang/go · critical · module.VersionError

verifying %s: checksum missing from sumdb response\n\nSECURI

Error message

verifying %s: checksum missing from sumdb response\n\nSECURITY ERROR\nThis download does NOT match one reported by the checksum server.\nThe checksum server has provided checksums, but the checksums do\nnot contain an entry for the download.\nThe checksum server may be malfunctioning, or an attacker may have\nintercepted the checksum request.\nThe download cannot be verified.\n\nFor more information, see 'go help module-auth'.\n

What it means

SECURITY-ERROR path: sumdb returned checksum lines but none of them reference the requested module+version at all. The database responded but omitted the entry, meaning the download cannot be verified — treated as a potential interception or malfunctioning DB.

Source

Thrown at src/cmd/go/internal/modfetch/fetch.go:873

		modWithoutSuffix.Version = before
	}

	db, lines, err := lookupSumDB(mod)
	if err != nil {
		return module.VersionError(modWithoutSuffix, fmt.Errorf("verifying %s: %v", noun, err))
	}

	have := mod.Path + " " + mod.Version + " " + h
	prefix := mod.Path + " " + mod.Version + " h1:"
	for _, line := range lines {
		if line == have {
			return nil
		}
		if strings.HasPrefix(line, prefix) {
			return module.VersionError(modWithoutSuffix, fmt.Errorf("verifying %s: checksum mismatch\n\tdownloaded: %v\n\t%s: %v"+sumdbMismatch, noun, h, db, line[len(prefix)-len("h1:"):]))
		}
	}
	return module.VersionError(modWithoutSuffix, fmt.Errorf("verifying %s: checksum missing from sumdb response"+sumdbAbsent, noun))
}

// Sum returns the checksum for the downloaded copy of the given module,
// if present in the download cache.
func Sum(ctx context.Context, mod module.Version) string {
	if cfg.GOMODCACHE == "" {
		// Do not use current directory.
		return ""
	}

	ziphash, err := CachePath(ctx, mod, "ziphash")
	if err != nil {
		return ""
	}
	data, err := lockedfile.Read(ziphash)
	if err != nil {
		return ""
	}

View on GitHub (pinned to b6b368adc5)

Solutions

Add the module path to GOPRIVATE (or GONOSUMDB) so it skips the public sumdb when the module is legitimately private or uncached.
For a public module, wait a few minutes for sum.golang.org to index and retry.
Confirm you are not pointed at a third-party sumdb mirror that is missing entries.
If the version was yanked, pick a different version that the sumdb still records.

Example fix

// before: private module hits public sumdb
//   GOPRIVATE=
// after
//   export GOPRIVATE=corp.example.com/*

Defensive patterns

Strategy: validation

Validate before calling

// Decide sumdb applicability before invoking go: private/unindexed modules
// must be in GOPRIVATE to avoid this error.
func shouldSkipSumdb(path, goprivate, gonosumdb string) bool {
    for _, pat := range strings.Split(goprivate+","+gonosumdb, ",") {
        if pat != "" && matchPattern(pat, path) { return true }
    }
    return false
}

Try / catch

// If the version is public but newly published, retry after a short delay to
// let sum.golang.org index it.
for i := 0; i < 5; i++ {
    if err := modfetch.CheckSumDB(mod, h); err == nil { break } 
    else if !strings.Contains(err.Error(), "checksum missing") { return err }
    time.Sleep(30 * time.Second)
}

Prevention

List every private/internal path in GOPRIVATE.
Wait for sum.golang.org to index freshly published public versions before depending on them in CI.
Validate your GONOSUMDB mirror actually has coverage for the modules you use.

When it happens

Trigger: checkSumDB finishes its loop without any line matching the prefix `path version h1:`. Falls through to the checksum-missing branch with sumdbAbsent.

Common situations: Brand-new or yanked version that sum.golang.org has not indexed; private module not in the public DB but not covered by GOPRIVATE/GONOSUMDB; corrupted sumdb mirror; race between upstream publish and sumdb indexing.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/489061c4d1429e8d. Report an issue: GitHub.