The Go team is providing a global go.sum database for authenticating module content.
Since Go 1.13, the go command by default downloads and authenticates modules using the Go checksum database. See sum.golang.google.cn/privacy for privacy information about this service and the go command documentation for configuration details including how to disable the use of this server or using different ones.
sum.golang.google.cn - an auditable checksum database which will be used by the go command to authenticate modules. Learn more in the go command documentation.
These services are ready for production use. Please file issues if you spot them, with the title prefix "sum.golang.google.cn".
GOPRIVATE and request a private module from this service,
what leaks?The proxy and checksum database protocols only send module paths and versions to the remote server. If you request a private module, the mirror will try to download it just as any Go user would and fail in the same way. Information about failed requests isn't published anywhere. The only trace of the request will be in internal logs, which are governed by the privacy policy.