# go: example.com/module@v1.0.0: verifying module: checksum mismatch
	downloaded: h1:abc123
	go.sum:     h1:xyz789

- **ID:** `go/checksum-mismatch`
- **Domain:** go
- **Category:** build_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The downloaded module's content does not match the hash recorded in go.sum, indicating possible tampering or corruption.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.11 | active | — | — |
| 1.12 | active | — | — |
| 1.13 | active | — | — |
| 1.14 | active | — | — |
| 1.15 | active | — | — |
| 1.16 | active | — | — |
| 1.17 | active | — | — |
| 1.18 | active | — | — |
| 1.19 | active | — | — |
| 1.20 | active | — | — |
| 1.21 | active | — | — |
| 1.22 | active | — | — |
| 1.23 | active | — | — |

## Workarounds

1. **Clear module cache and re-download** (85% success)
   ```
   go clean -modcache && go mod download
   ```
2. **Set GONOSUMCHECK to bypass verification for that module (temporary)** (70% success)
   ```
   export GONOSUMCHECK=example.com/module && go mod download
   ```

## Dead Ends

- **Manually editing go.sum to match the downloaded hash** — This bypasses security; the downloaded module may be malicious or corrupted. (90% fail)
- **Ignoring the error with -insecure flag** — Go does not support -insecure for module verification; it will still fail. (95% fail)