By default (as per external documentation) Go can use the GOPROXY to get the GOSUM. This can be seen if you do not set GOSUMDB and leave it as default (sum.golang.org).
If we run a Go command we will see in the remote repository in Artifactory that a request was sent through the Go remote repository to get the GOSUM as it has been cached in the remote repository. The following screenshots are from Artifactory 7.46.11.
An example Go command:
go clean -cache -modcache && go get -v github.com/go-git/go-git-fixtures/v4@v4.2.2
But there may be some use cases where you want to set up a separate GOSUMDB repository and set the GOSUMDB to point to that repository so that it will resolve the GOSUMs through it instead.
To do this in your GOSUMDB variable it will follow a different format which may not be intuitive or expected (external reference ). The GOSUMDB should still have the name of the checksum database in front but follow it with the Artifactory URL to the repository.
GOSUMDB example (go-gosumdb-remote being a remote repository in Artifactory):
export GOSUMDB="sum.golang.org <ART_URL>/artifactory/go-gosumdb-remote"
Also note that the URL in the GOSUMDB does not have the “api/go” in the URL like with the GOPROXY variable. This is because it is not a Go repository but a checksum database for Go packages.
GOPROXY with Artifactory in comparison (go-go being my virtual Go repository name in Artifactory):
export GOPROXY="<ART_URL>/artifactory/api/go/go-go"
Using the same Go command I can now see that the GOSUM requests went through the configured go-gosumdb-remote repository instead and is cached there.
In this example the remote repository is just pointing to the default Go checksum database, sum.golang.org: