}

	if gosumdb == "off" {
		return "", nil, fmt.Errorf("checksum database disabled by GOSUMDB=off")
	}

	key := strings.Fields(gosumdb)
	if len(key) >= 1 {
		if k := knownGOSUMDB[key[0]]; k != "" {
			key[0] = k
		}
	}
	if len(key) == 0 {
		return "", nil, fmt.Errorf("missing GOSUMDB")
	}
	if len(key) > 2 {
		return "", nil, fmt.Errorf("invalid GOSUMDB: too many fields")
	}

stdout go1.999testmod

# GOTOOLCHAIN with GOSUMDB enabled but at a bad URL should operate in cache and not try badurl
env oldsumdb=$GOSUMDB
env GOSUMDB=$oldsumdb' http://badurl'
go version
! stderr downloading
stdout go1.999testmod

# GOTOOLCHAIN with GOSUMB=off should fail, because it cannot access even the cached sumdb info
# without the sumdb name.
env GOSUMDB=off
! go version

env GO111MODULE=on
env sumdb=$GOSUMDB
env proxy=$GOPROXY
env GOPROXY GONOPROXY GOSUMDB GONOSUMDB

# basic fetch (through proxy) works
cp go.mod.orig go.mod
go get rsc.io/fortune@v1.0.0 # note: must use test proxy, does not exist in real world
rm $GOPATH/pkg/mod/cache/download/sumdb # rm sumdb cache but NOT package download cache
rm go.sum

# can fetch by explicit URL
cp go.mod.orig go.mod
env GOSUMDB=$sumdb' '$proxy/sumdb-direct

env GO111MODULE=on
env sumdb=$GOSUMDB
env proxy=$GOPROXY
env GOPRIVATE GOPROXY GONOPROXY GOSUMDB GONOSUMDB
env dbname=localhost.localdev/sumdb

# disagree with sumdb fails
cp go.mod.orig go.mod
env GOSUMDB=$sumdb' '$proxy/sumdb-wrong
! go get rsc.io/quote
stderr 'SECURITY ERROR'

# GONOSUMDB bypasses sumdb, for rsc.io/quote, rsc.io/sampler, golang.org/x/text
env GONOSUMDB='*/quote,*/*mple*,golang.org/x'
go get rsc.io/quote
rm go.sum

# Test default GOPROXY and GOSUMDB
[go-builder] env GOPROXY=
[go-builder] env GOSUMDB=
[go-builder] go env GOPROXY
[go-builder] stdout '^https://proxy.golang.org,direct$'
[go-builder] go env GOSUMDB
[go-builder] stdout '^sum.golang.org$'
[go-builder] env GOPROXY=https://proxy.golang.org
[go-builder] go env GOSUMDB
[go-builder] stdout '^sum.golang.org$'

# Download direct from github.

[!net:proxy.golang.org] skip
[!net:sum.golang.org] skip

env GO111MODULE=on
env sumdb=$GOSUMDB
env proxy=$GOPROXY
env GOPROXY GONOPROXY GOSUMDB GONOSUMDB
env dbname=localhost.localdev/sumdb

# disagreeing with the sumdb produces security errors
# (this also populates tiles on the sumdb server).
cp go.mod.orig go.mod
env GOSUMDB=$sumdb' '$proxy/sumdb-wrong
! go get rsc.io/quote
stderr 'go: rsc.io/quote@v1.5.2: verifying module: checksum mismatch'
stderr 'downloaded: h1:3fEy'

# Test query for non-defaults in the env

env GOROOT=./a
env GOTOOLCHAIN=local
env GOSUMDB=nodefault
env GOPROXY=nodefault
env GO111MODULE=auto
env CGO_CFLAGS=nodefault
env CGO_CPPFLAGS=nodefault

go env -changed
# linux output like GOTOOLCHAIN='local'
# windows output like GOTOOLCHAIN=local
stdout 'GOTOOLCHAIN=''?local''?'
stdout 'GOSUMDB=''?nodefault''?'
stdout 'GOPROXY=''?nodefault''?'
stdout 'GO111MODULE=''?auto''?'

env GO111MODULE=on
env sumdb=$GOSUMDB
env proxy=$GOPROXY
env GOPROXY GONOPROXY GOSUMDB GONOSUMDB

# rejected proxy fails verification
cp go.mod.orig go.mod
rm go.sum
env GOPROXY=$proxy/sumdb-503
! go get rsc.io/quote
stderr 503

# fetch through working proxy is OK
cp go.mod.orig go.mod
rm go.sum
env GOPROXY=$proxy
go get rsc.io/quote

# repeated fetch works entirely from cache, does not consult sumdb
cp go.mod.orig go.mod

env GO111MODULE=on

[!net:golang.org] skip
[!net:proxy.golang.org] skip

env GOPROXY=https://proxy.golang.org,direct
env GOSUMDB=off

go get -x -v golang.org/x/tools/cmd/goimports
stderr '# get https://proxy.golang.org/golang.org/x/tools/@v/list'
! stderr '# get https://golang.org'

-- go.mod --
module m

env GO111MODULE=on
env GOSUMDB=$sumdb' '$proxy/sumdb-wrong

# download -json with version should print JSON on sumdb failure
! go mod download -json 'rsc.io/quote@<=v1.5.0'
stdout '"Error": ".*verifying (module|go.mod)'

-- go.mod --