# Go: verifying module: checksum mismatch — SECURITY ERROR This download does NOT match an earlier download recorded in go.sum

**Code:** `verifying module: checksum mismatch / SECURITY ERROR` · **Category:** Go · **Seen on:** Go

A module's content hash differs from the one recorded in `go.sum` (or the public checksum database).

## Meaning

Do not ignore it. Common benign causes: a tag was force-moved/rewritten by the maintainer, a corrupted cache, or a stale local go.sum. Investigate before accepting: compare against the sumdb, clear the cache (`go clean -modcache`), then regenerate the entry only if you trust the new content.

## Common causes

- Upstream retagged a version (force push)
- Corrupt module cache
- go.sum edited or merged incorrectly
- Proxy returning different content
- Genuine tampering (rare, but why the check exists)

## Quick fix

1. Run `go clean -modcache` and retry
2. Compare with `GOSUMDB` (sum.golang.org) and the upstream tag
3. Remove the go.sum line and run `go mod tidy` only after verifying the source

## Detailed fix by platform

### Go

1. `go clean -modcache && go mod download` then `go mod verify`

## How to diagnose

1. **Module** — Which version?
2. **Tag** — Rewritten upstream?
3. **Cache** — Cleared?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/go/checksum-mismatch-security-error)