GOPRIVATE, GONOPROXY and GONOSUMDB: what each Go setting does

GOPRIVATE is a list of glob patterns for module paths that are private. It is the default for GONOPROXY, which skips proxies, and GONOSUMDB, which skips the public checksum database. For most teams, setting GOPRIVATE to your company's module prefix is enough. Use the narrower variables only when you need different behavior.

The five variables

The Go modules reference describes each one:

• GOPROXY is the list of module proxy URLs, tried in sequence. The keyword direct means fetch from version control.
• GOPRIVATE is a list of glob patterns of module path prefixes considered private. It acts as the default for GONOPROXY and GONOSUMDB.
• GONOPROXY lists prefixes that should not be downloaded from a proxy. Matching modules come from version control regardless of GOPROXY.
• GONOSUMDB lists prefixes that should not be checked against the public checksum database.
• GOINSECURE lists prefixes that may be retrieved over HTTP and other insecure protocols.

The patterns use the syntax of Go's path.Match, comma separated.

A typical setup

GOPRIVATE=git.example.com/acme/*

With only that set, modules under git.example.com/acme are fetched directly and are not looked up in the public checksum database. Everything else still goes through the default proxy and is verified.

Why the checksum database matters

GOSUMDB names the checksum database. The reference gives the default as sum.golang.org, run by Google, and says it can be set to off to disable it entirely. Turning it off for everything removes a check that catches a module whose contents changed after you first fetched it. Prefer GONOSUMDB or GOPRIVATE for the few private paths instead.

Common mistakes

1. Setting GOPRIVATE too broadly, such as a whole host, when only one organization is private.
2. Setting GONOSUMDB for a public module path because a download failed, which hides a real integrity problem.
3. Using GOINSECURE for a company server instead of fixing its certificate.
4. Setting these variables only on developer laptops, not in CI, so builds behave differently.

Put the variables in a committed file or CI configuration so every environment matches. You can write them with go env -w for a developer machine.

How it fits with a company proxy

Private patterns skip proxies. A company proxy handles the rest. Choose the separator carefully: see GOPROXY comma versus pipe.

Safeguard dependency and SBOM scanning can list the modules a build resolves and flag known vulnerabilities. You can try a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• Go modules reference

Last reviewed: 19 October 2026.