The Go team is providing a global go.sum database for authenticating module content.
As of Go 1.13, the go command by default downloads and authenticates modules using the Go checksum database. See sum.golang.google.cn/privacy for privacy information about this service and the go command documentation for configuration details including how to disable the use of this server or using different ones.
sum.golang.google.cn - an auditable checksum database which will be used by the go command to authenticate modules. This serves contents that are signed by sum.golang.org. Check out the Secure the Public Go Module Ecosystem Proposal for more details.
These services are ready for production use. Please file issues if you spot them, with the title prefix "sum.golang.google.cn".
Older versions of the go command prior to Go 1.13 cannot directly use the checksum database.
GOPRIVATEand request a private module from this service, what leaks?