What version of Go are you using (go version)?

$ go version

go version devel +5f45a3337e Wed Aug 14 19:49:15 2019 +0000 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/iand/.cache/go-build"
GOENV="/home/iand/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/iand"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/opt/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/opt/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/iand/wip/--elided---/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build133450829=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Ran go mod tidy

What did you expect to see?

Instructions for investigating the cause and potential resolution of a checksum mismatch.

What did you see instead?

10:24 $ go mod tidy
verifying gotest.tools@v2.2.0+incompatible: checksum mismatch
	downloaded: h1:y0IMTfclpMdsdIbr6uwmJn5/WZ7vFuObxDMdrylFM3A=
	sum.golang.org: h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

This information, while correct, is not very informative for most users. It tells them the problem but doesn't indicate how they can resolve it. Their build will not progress until they resolve the problem.

go help module-auth provides very detailed information on the operation of the module checksum mechanism but doesn't help the typical user get their build working.

In my case go clean -modcache solved my problem although I am left with the feeling that I just did the module analog of "switching it off and on again".

The message would be more informative if it told me where the downloaded code is and how I can cross reference that with the code the checksum server saw.