Go "verifying X: checksum mismatch" against GOSUMDB - Fix in CI

By Kaveh Alemi·Latchkey

Go verifies every download against go.sum and the public sum database (GOSUMDB). A mismatch means the bytes you got do not match a recorded checksum - a security signal, not noise.

What this error means

A download fails with verifying X: checksum mismatch and SECURITY ERROR, showing the downloaded hash versus the recorded one. It can mean a republished module, a stale go.sum, or a tampering proxy.

verifying github.com/foo/bar@v1.2.3: checksum mismatch
	downloaded: h1:aaa...
	sum.golang.org: h1:bbb...
SECURITY ERROR
This download does NOT match the one reported by the checksum server.

Common causes

Module republished under the same version

A tag was force-moved or re-released with different content, so the recorded hash no longer matches.

Stale or hand-edited go.sum

go.sum carries an old or altered checksum that no longer matches the real bytes.

Proxy serving different content

A misbehaving or poisoned proxy returned bytes that disagree with GOSUMDB.

How to fix it

Investigate before trusting

1. Treat the mismatch as a security signal, not a flake.
2. Confirm the upstream version was not force-pushed; if it was, pin a clean version.

Refresh go.sum for a legitimate change

1. Remove the stale entry and re-download to record the current checksum after verifying the source.

GOFLAGS=-mod=mod go mod download github.com/foo/bar
go mod tidy

How to prevent it

• Pin exact versions and avoid mutable tags.
• Never disable the sum database as a blanket fix.
• Cache the module cache so all jobs verify against the same bytes.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation