What does go:go_private_module_reached_sumdb mean?

Go sent a module path to the public checksum database. For a private path, the checksum privacy boundary is configured incorrectly.

Which Go versions are affected by go:go_private_module_reached_sumdb?

The public module mirror and checksum database have been defaults since Go 1.13. Private-proxy configuration depends on your intended trust model.

Go error: private module request reached sum.golang.org

Q: How can I manually validate go:go_private_module_reached_sumdb?

Run `go env GOPROXY GOPRIVATE GONOPROXY GONOSUMDB GOSUMDB` in the failing environment. Decide whether the module is public, direct private VCS, or served by the trusted RepoFlow proxy. Check each glob against the full module path. Go path patterns match prefixes according to `path.Match`, and a visually similar value may not cover the intended namespace.

Q: How do I prevent go:go_private_module_reached_sumdb in CI?

Document private module prefixes and whether each namespace uses direct VCS or the trusted proxy. Provision privacy variables before the first module fetch in CI and container images. Test for outbound public proxy and sumdb requests from a representative private-module build.

Fix it fast

Most likely: The private prefix is missing from the checksum exemption, or GOPRIVATE is bypassing a proxy you intended to use.

Confirm this is your error

Match the output and confirm you are troubleshooting the same failure.

go: corp.example.com/team/lib@v1.2.3: verifying module: reading https://sum.golang.org/lookup/corp.example.com/team/lib@v1.2.3: 404 Not Found
go: corp.example.com/team/lib@v1.2.3: verifying module: reading https://sum.golang.org/lookup/corp.example.com/team/lib@v1.2.3: 410 Gone

Check the cause

Run focused checks to identify what is failing in this environment.

go env GOPROXY GOPRIVATE GONOPROXY GONOSUMDB GOSUMDB
go mod download -x <module>@<version>

Apply the safe fix

Use the smallest safe change that addresses the confirmed cause.

# Preserve existing patterns and set the reviewed merged value.
# Direct private VCS strategy
go env -w GOPRIVATE='<merged-private-patterns>'

# Trusted private proxy strategy: keep GOPROXY and exempt only public sumdb
go env -w GONOSUMDB='<merged-private-patterns>'
# Also ensure GONOPROXY does not match this prefix.

Verify it works

Repeat the relevant checks and confirm the original error is gone.

go env GOPROXY GOPRIVATE GONOPROXY GONOSUMDB
go mod download -x <module>@<version>

Avoid unsafe shortcuts

Keep security and data protections in place while troubleshooting.

Do not disable GOSUMDB globally for one private namespace.
Do not set GOPRIVATE blindly when the private module should continue through RepoFlow.

What This Error Means

Read this as a precise clue about which part of the workflow broke first. Once you know the failing layer, the fix path gets much shorter.

How to Fix It

The fastest fixes here come from checking the immediate failing layer before you change anything unrelated. Make one correction at a time and re-test from the same environment.

Direct VCS:add the prefix to GOPRIVATE so it bypasses public proxies and sum.golang.org.

Trusted proxy:keep RepoFlow in GOPROXY, add the prefix to GONOSUMDB, and ensure GONOPROXY does not match it.

Mixed strategy:set GONOPROXY and GONOSUMDB explicitly rather than relying on the GOPRIVATE defaults.

Public module:keep checksum verification enabled and diagnose the version, proxy, or sumdb availability instead of classifying it as private.

CI mismatch:apply the approved values in the runner or container stage that downloads modules.

Why It Happens

A direct private-module workflow is missing the namespace from GOPRIVATE.

A trusted-private-proxy workflow is missing the namespace from GONOSUMDB.

GONOPROXY inherited a GOPRIVATE value and bypassed the private proxy unexpectedly.

The module is public, but its requested version is unavailable from sum.golang.org.

Verify the Fix

Run go mod download -x <module>@<version> and confirm a private module no longer sends a lookup to sum.golang.org, and confirm it uses the intended VCS or RepoFlow path and public modules still use checksum verification.

Classify the module and intended fetch path

Run go env GOPROXY GOPRIVATE GONOPROXY GONOSUMDB GOSUMDB in the failing environment.

Decide whether the module is public, direct private VCS, or served by the trusted RepoFlow proxy.

Check each glob against the full module path. Go path patterns match prefixes according to path.Match, and a visually similar value may not cover the intended namespace.

How Go decides whether to contact the checksum database

When go.sum lacks a hash, Go normally asks the configured checksum database to authenticate public module content. GOPRIVATE defaults both GONOPROXY and GONOSUMDB. For a trusted private proxy, exclude private paths from the public checksum database without bypassing GOPROXY.

Prevent It From Coming Back

To prevent this, document private module prefixes and whether each namespace uses direct VCS or the trusted proxy, provision privacy variables before the first module fetch in CI and container images, and test for outbound public proxy and sumdb requests from a representative private-module build.

Docs and source code

Go Modules Reference

Official reference for module files, version selection, proxies, private modules, checksums, workspaces, and vendoring. - Source

The go command uses module paths and versions to resolve, download, and authenticate dependencies.

Managing Dependencies

Official task guidance for dependency changes and GOPROXY comma-versus-pipe fallback behavior. - Source

Comma-separated proxies fall through on 404 or 410. Pipe-separated proxies fall through on any error.