Changes to default GOSUMDB environment variable on the Mend Developer Platform (and what it means for private Go modules)
#40041
jamietanna
announced in
Maintainer announcements
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Note
This only affects Renovate Cloud on
developer.mend.io(Mend Developer Platform), and does not modify anything for users of the Renovate CLI deployed as part of any self-hosted usage.This also does not affect any Mend Renovate Self-Hosted (Community Edition or Enterprise Edition) users.
Note
This only affects you if you are interacting with Go module dependencies. If you do not use Go modules with the Mend Developer Platform, you can disregard this.
Timeline
We decided not to follow the announcement + community feedback process, which we outlined in October, as it would've introduced increased risk of supply chain attack exposure.
If you are reading this, the change has already been made.
What's changed?
On the Mend Developer Platform, the means to authenticate Go modules' authentication was previously switched off, by setting the environment variable
GOSUMDB=offglobally.As part of a change made today (2025-12-17), we have unset this variable, so it will use the defaults from the Go toolchain.
(For instance, in Go 1.25, this will set
GOSUMDB=sum.golang.org)What's the impact to me? What action(s) may I need to take?
If you use private Go module dependencies, you should see Renovate continue to detect and/or propose PR updates, but will fail with
Artifact update problems:Example "Artifact update problem" PR comment
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: go.sum
This happens due to the
gotoolchain not knowing that you have private dependencies, even though it has authentication (via Renovate's Host Rules).You can also see this failing in the Renovate debug logs:
Full debug logs
Recommended action (for Community/free users)
Follow the Go documentation on authenticating to private Go modules.
For instance, if you have predominantly (or all) private Go modules from
github.com/JamieTanna-Mend-testing, you could setGOPRIVATE=github.com/JamieTanna-Mend-testing/*.Follow the best practices guidance in the ecosystem when setting
GOPRIVATEandGONOSUMDBto ensure that you're not over-including module names (in case you have public modules that get included byGOPRIVATE, which will mean that the Go Checksum database isn't being checked for any of those public packages).It is possible to set the
GOPRIVATEandGONOSUMDBin theenvrepo config, as Mend have allowlistedGO*environment variables to be set.For instance:
{ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "env": { "GOPRIVATE": "github.com/JamieTanna-Mend-testing/*" } }As these are repo-level config options, you can also specify this in your Inherited Config, or in any shared config presets.
There are also discussions internally at Mend around adding a UI setting to set "environment variables" (for non-secret values), which will allow for providing these in a more "ClickOps" fashion.
Recommended action (for Enterprise customers)
We have worked with Enterprise customers and prepared a
GOPRIVATEoverride for their repos, based on the private Go modules that we know they are using.The
GOPRIVATEvariable has been set on the organization level's Secrets, as an environment variable that is exposed to the Renovate CLI.Why was it set to
GOSUMDB=off?As part of looking into correcting this setting, we first needed to investigate why this had happened, so we could understand whether there was some context that was missing.
Before Renovate 38, Containerbase (which the Renovate Docker image is built on top of) would set
GOSUMDB=offas part of its base configuration, and so when Renovate would execute thegotoolchain, this would disable Go module checksum verification, allowing private module authentication to work.However, we knew this to be insecure (and a key protection Go has against supply chain attacks), and so in Renovate 38 (2024-07-25), we removed this via a change in Containerbase, which we then merged in as part of the Renovate release.
We found that while investigating Go module failures with private authentication after Renovate 38's release, both self-hosted and hosted users saw issues with updating private Go modules.
While we worked to provide a solution for the hosted users (working with self-hosted users to confirm the relevant changes needed), we set
GOSUMDB=offon the Mend Developer Platform as a temporary workaround.As with many great "temporary workarounds", we didn't end up coming back to fix it fully - until now.
Why was the change made to revert
GOSUMDBto the default values?We (Mend) changed this setting as part of ongoing efforts to ensure that the Open Source Mend Renovate CLI and the Mend-hosted Renovate Cloud are secure-by-default.
As part of this, leaving the primary means for Go module integrity disabled and unenforced, for the benefit of a subset of users using private Go modules, was not an acceptable trade-off for the wide ecosystem of users who rely on our platform.
We appreciate that this may lead to some breakage of private Go modules, and as seen above, have suggested steps to take as a one-time migration.
What was the impact of us not making this change?
Given proximity to the winter break for a lot of folks around the world, we wanted to make the change now instead of waiting until the new year.
Considering the attack vector that this could lead to, we did not want to leave this in place any longer than it already has been.
Note that even if an attack like this could have occurred, and Renovate raised PRs that had a mismatched checksum in the
go.sum, a repository's CI/CD executing subcommands in thegotoolchain i.e.go testorgo mod tidywould have flagged this as an issue. Regardless, moving to more secure defaults is the best choice here.Beta Was this translation helpful? Give feedback.
All reactions