cmd/go: toolchain downloads fails with `verifying module: invalid GOSUMDB: malformed verifier id`

[SimonBaeumer]

Go version

go version go1.22.6 linux/amd64

Output of go env in your module/workspace:

GO111MODULE='on'
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/sbaumer/.cache/go-build'
GOENV='/home/sbaumer/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS='-buildvcs=false'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/sbaumer/go/pkg/mod'
GONOPROXY='github.com/stackrox'
GONOSUMDB='github.com/stackrox'
GOOS='linux'
GOPATH='/home/sbaumer/go'
GOPRIVATE='github.com/stackrox'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='on'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.6'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/sbaumer/go/src/github.com/cri-o/cri-o/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build245464977=/tmp/go-build -gno-record-gcc-switches'

What did you do?

I've tried to run the go command, but as soon as it executes it tries to download the toolchain and fails. I could work around this issue by upgrading to 1.22.6, but this just skips downloading a toolchain. When setting GOTOOLCHAIN=1.21.9 I am still getting this error.

This issue blocks a lot scripts because it happens also on go calls without invoking subcommands, often blocking setups in .bashrc & .zshrc files.

$ GOTOOLCHAIN=go1.21.9 go
go: downloading go1.21.9 (linux/amd64)
go: download go1.21.9: golang.org/toolchain@v0.0.1-go1.21.9.linux-amd64: verifying module: invalid GOSUMDB: malformed verifier id

What did you see happen?

Run go command fails

$ GOTOOLCHAIN=go1.21.9 go
go: downloading go1.21.9 (linux/amd64)
go: download go1.21.9: golang.org/toolchain@v0.0.1-go1.21.9.linux-amd64: verifying module: invalid GOSUMDB: malformed verifier id

$ GOTOOLCHAIN=go1.21.9 GOSUMDB=off go mod tidy
go: downloading go1.21.9 (linux/amd64)
go: download go1.21.9: golang.org/toolchain@v0.0.1-go1.21.9.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

Run with strace

$ GOTOOLCHAIN=go1.21.9 strace -e open go mod tidy
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
go: downloading go1.21.9 (linux/amd64)
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
--- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=35360, si_uid=4200654} ---
go: download go1.21.9: golang.org/toolchain@v0.0.1-go1.21.9.linux-amd64: verifying module: invalid GOSUMDB: malformed verifier id
+++ exited with 1 +++

Execute from home dir without any go.mod

$ pwd
/home/sbaumer

$ GOTOOLCHAIN=go1.21.9 go build -v -a -n internal/godebugs
go: downloading go1.21.9 (linux/amd64)
go: download go1.21.9: golang.org/toolchain@v0.0.1-go1.21.9.linux-amd64: verifying module: invalid GOSUMDB: malformed verifier id

What did you expect to see?

A successful build.

I am happy to help with debugging and thankful for any pointers.

[gabyhelp]

Related Issues and Documentation

• cmd/go: mod tidy reports toolchain not available with 'go 1.21' #62278 (closed)
• x/tools/cmd/getgo: cannot install Go 1.21 #63367 (closed)
• cmd/go: malformed go.sum error is ignored #62345 (closed)
• cmd/go: require directive fails verifying local modules #33873 (closed)
• cmd/go: TestScript/gotoolchain_issue66175 fails on tip locally #67277 (closed)
• build: the build of go bootstrap in case of compilation errors does not stop cleanly #45410 (closed)
• go get #56314 (closed)
• cmd/dist: I/O error: read src/xxx.go: is a directory #35776 (closed)
• cmd/go: global go get does not reference main package's module's go.sum #37225 (closed)
• `go install` fails when `GOPROXY` is empty #62274 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[SimonBaeumer]

It seemed that my environment was wrong. My setting was GOSUMDB=on which is an invalid parameter. After finding the correct documentation at https://github.com/goproxyio/goproxy.io/blob/master/content/docs/GOSUMDB-env.md I've run go env -w GOSUMDB='sum.golang.org' and it works again.

It was not very obvious what caused this issue and the doc is hidden, improving documentation on this parameter would be great.
I am leaving this issue open, but the problem itself is resolved.

[seankhliao]

it seems quite obvious, the error mentioned that GOSUMDB was invalid

[porridge]

it seems quite obvious, the error mentioned that GOSUMDB was invalid

I think it would have been obvious if it mentioned $GOSUMDB. Just using capitals didn't ring the bell loud enough here 😅