Go "verifying ...: 404 Not Found" - Fix GONOSUMDB / GOFLAGS in CI
By Kaveh Alemi·Latchkey
Go went to verify a module against the public checksum database and got a 404 because the database has no record of it - typically a module served only by an internal proxy or mirror that never reaches the public sum DB.
What this error means
A fetch through an internal mirror fails at verifying <module>@<version>: ... 404 Not Found. The module downloads, but the public sum DB lookup 404s because it has never seen that module path.
go output
verifying github.com/org/lib@v1.2.0: github.com/org/lib@v1.2.0:
reading https://sum.golang.org/lookup/github.com/org/lib@v1.2.0:
404 Not Found
Common causes
A mirror-only module the public sum DB does not know
A module served exclusively by an internal proxy/mirror was never published publicly, so sum.golang.org returns 404 when Go tries to verify it.
Transient failure reaching the sum DB
An intermittent network or DNS issue reaching sum.golang.org can surface as a verification failure that clears on retry.
How to fix it
Scope the module out of the public sum DB
Name the paths whose checksums should not be looked up publicly so Go trusts the mirror instead.
Terminal
export GONOSUMDB=github.com/org/*
# or skip the sum DB entirely for internal builds
export GOFLAGS=-mod=mod GONOSUMCHECK=1
Point GOSUMDB at off for mirror-served builds
When every module comes from a trusted internal mirror, turn the public sum DB off for the job.
Terminal
export GOSUMDB=off
go mod download
Retry a transient sum-DB failure
A genuine 404 for a mirror-only path will not fix itself, but an intermittent network error reaching the sum DB usually clears on a second attempt.
How to prevent it
Set GONOSUMDB/GOSUMDB=off for modules served only by an internal mirror.
Keep public modules on the public sum DB so the tamper check stays intact.
Cache the module cache so sum-DB lookups happen less often.
Frequently asked questions
What causes ""verifying ...: 404 Not Found""?
A module served exclusively by an internal proxy/mirror was never published publicly, so sum.golang.org returns 404 when Go tries to verify it.
How do I fix "verifying ...: 404 Not Found"?
Name the paths whose checksums should not be looked up publicly so Go trusts the mirror instead.
Can Latchkey fix this automatically?
Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.
