go build_error ai_generated true

go: example.com/[email protected]: verifying module: checksum mismatch downloaded: h1:abc123 go.sum: h1:xyz789

ID: go/checksum-mismatch

Also available as: JSON · Markdown · 中文
80%Fix Rate
88%Confidence
0Evidence
2024-10-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.11 active — — —
1.12 active — — —
1.13 active — — —
1.14 active — — —
1.15 active — — —
1.16 active — — —
1.17 active — — —
1.18 active — — —
1.19 active — — —
1.20 active — — —
1.21 active — — —
1.22 active — — —
1.23 active — — —

Root Cause

The downloaded module's content does not match the hash recorded in go.sum, indicating possible tampering or corruption.

generic

中文

下载的模块内容与 go.sum 中记录的哈希不匹配，表明可能被篡改或损坏。

Workarounds

  1. 85% success Clear module cache and re-download 
    go clean -modcache && go mod download
  2. 70% success Set GONOSUMCHECK to bypass verification for that module (temporary) 
    export GONOSUMCHECK=example.com/module && go mod download

Dead Ends

Common approaches that don't work:

  1. Manually editing go.sum to match the downloaded hash 90% fail

    This bypasses security; the downloaded module may be malicious or corrupted.

  2. Ignoring the error with -insecure flag 95% fail

    Go does not support -insecure for module verification; it will still fail.