@golang/tools-team

I have fallen into the same scenario. Have to disable go mod verify in all the repos that use go.work

+1 It's surprising to see no comments on this issue. Is no one using workspaces or are we somehow doing it incorrectly?

CC @bcmills @matloob

Related discussion on #50750 (comment)

Not even setting GOPRIVATE to github.com (horrible practice, I'd expect to use github.com/<organization-name>) I could manage to make this work.

go mod verify verifies modules that have already been downloaded, without downloading them itself.

Modules that have not been downloaded (as might be the case when working exclusively within a larger workspace) are supposed to be skipped during verification. Probably something in that logic is not working as intended.

FWIW: go work sync seems to usually clear this up for me.

having the same issue, and go work sync does not solve it

Actually nevermind. go work sync "solved" it once and only once.

Change https://go.dev/cl/485475 mentions this issue: cmd/go: skip over all workspace modules in go mod verify

Is this really fixed? I can reproduce this by running go mod verify in a project like https://github.com/siderolabs/talos. I cloned it to /tmp and then got:

$ go mod verify
module-sig-verify : missing ziphash: open hash: no such file or directory

$ go version
go version go1.21.1 linux/amd64

$ go env
GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/gbrlsnchs/.cache/go-build'
GOENV='/home/gbrlsnchs/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/gbrlsnchs/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/gbrlsnchs/go'
GOPRIVATE=''
GOPROXY='direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.1'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='x86_64-pc-linux-gnu-gcc'
CXX='x86_64-pc-linux-gnu-g++'
CGO_ENABLED='1'
GOMOD='/tmp/talos/go.mod'
GOWORK='/tmp/talos/go.work'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build975863248=/tmp/go-build -gno-record-gcc-switches'

@gbrlsnchs, one underlying cause was fixed. If you are seeing a similar symptom, it likely has a different cause; please open a new issue with steps to reproduce the error. (Notably, it would help to have a specific commit at which you observed it.)