# Go "GOFLAGS: ... not allowed" / GONOSUMCHECK Errors - Fix in CI

> Fix Go "GOFLAGS: ... cannot be set" and unrecognized GONOSUMCHECK/GONOSUMDB in CI - a malformed environment variable that the go command rejects before building.

Source: https://latchkey.dev/learn/go/go-gonosumcheck-goflags-env-rejected  
Updated: 2026-06-25

Go reads `GOFLAGS`, `GONOSUMDB`, and the legacy `GONOSUMCHECK` from the environment. A malformed value - a flag that go does not accept, or a deprecated variable used where Go now expects `GONOSUMDB`/`GOPRIVATE` - makes the command fail before it does any module work.

## Diagnose it: module path, proxy, or checksum?

Go module errors name the module but rarely the layer that failed. Separate the three: the module path does not resolve, the proxy cannot serve it, or the checksum database disagrees with what was downloaded.

```Terminal
# what Go resolves and from where
go env GOPROXY GOSUMDB GOPRIVATE GOFLAGS

# does the module resolve at all, bypassing the build?
go list -m -versions github.com/org/module

# verify the module cache against go.sum
go mod verify

# private modules must be excluded from proxy and sumdb
go env -w GOPRIVATE=github.com/yourorg/*
```

> A private module fetched through the public proxy fails with a confusing 410 or checksum mismatch rather than an auth error. Setting `GOPRIVATE` for your org prefix removes an entire class of CI-only module failures.

## FAQ

### What causes Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors?

There are 2 common causes: a malformed goflags value and using deprecated gonosumcheck. GOFLAGS must be a space-separated list of valid flags.

### How do I fix Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors?

There are 3 fixes depending on which cause you have: write goflags as valid flags, replace gonosumcheck with gonosumdb / goprivate, and inspect the effective environment. Work through them in order, since the first is the most common.

### What does Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors actually mean?

A go command fails immediately with go: GOFLAGS=...: ...

### How do I stop Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors happening again?

Set GOFLAGS as a space-separated list of =-valued flags. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt