The Go team is providing a global go.sum database for authenticating module content.
Since Go 1.13, the go command by default downloads and authenticates modules using the Go checksum database. See sum.golang.google.cn/privacy for privacy information about this service and the go command documentation for configuration details including how to disable the use of this server or using different ones.
These services are ready for production use. Please file issues if you spot them, with the title prefix "sum.golang.google.cn".
GOPRIVATEand request a private module from this service, what leaks?