Problem: go get/build times out: proxy.golang.org dial i/o timeout (Google IPs) —— Trove problem library

What you will run into

go get / go mod download / go build (first dependency fetch) reports go: ...: Get "https://proxy.golang.org/...": dial tcp 142.250.69.177:443: i/o timeout.

The IP in the error is Google's range (142.250.x / 142.251.x / 173.194.x) — direct connections from CN networks to Go's default proxy always time out; the same machine may work a while later, it's network fluctuation, not a code problem.

Why this happens

Go's default module proxy proxy.golang.org (and checksum service sum.golang.org) is hosted on Google infrastructure; direct connections from CN are unstable, and the TCP dial just times out.

The public CN proxy goproxy.cn (Qiniu) is the officially documented option for Chinese users; there are also goproxy.io and corporate Athens/nexus proxies.

Go module downloads are two stages: "GOPROXY resolution + GOSUMDB verification".

GOPROXY decides which proxy fetches modules (default proxy.golang.org on Google infrastructure — direct TCP dialing times out from domestic networks);

GOSUMDB decides which checksum server verifies module hashes (default sum.golang.org, also not directly reachable).

Switching only GOPROXY without handling GOSUMDB still stalls at the checksum stage; domestic proxies like goproxy.cn usually also provide sumdb proxying (GOSUMDB=sum.golang.google.cn or the proxy's own sumdb service).

Deterministic takeaway: when go mod download hangs, identify which stage — GOPROXY (fetching modules) or GOSUMDB (verifying hashes); go env GOPROXY GOSUMDB shows current values; the standard domestic config is GOPROXY=https://goproxy.cn,direct GOSUMDB=sum.golang.google.cn;

with an in-house Athens/nexus, GOSUMDB may need to be off (the internal proxy does its own integrity verification — a different trust chain); fixed diagnostic: the error URL containing proxy.golang.org = GOPROXY problem; sum.golang.org = GOSUMDB problem.

Step by step

1. Temporary — Required

GOPROXY=https://goproxy.cn,direct go get ...

2. Persistent (user level) — Required

go env -w GOPROXY=https://goproxy.cn,direct
go env -w GOSUMDB=sum.golang.org

goproxy.cn relays checksums fine; domestically you usually don't need to disable sumdb.

3. Precedence matters — Required

Env var GOPROXY=... (exported in shell/system) > go env -w value > default.

If GOPROXY is exported in the shell, go env -w has no effect (measured warning: "does not override conflicting OS environment variable") — change the export at its source (~/.bashrc / /etc/environment), or use explicit GOPROXY=... go ... per command.

4. Checksum service also times out — Required

GOSUMDB=sum.golang.google.cn (CN-reachable mirror), or GOSUMDB=off (sacrifices supply-chain verification; not recommended persistently).

5. Private modules — Required

For corporate intranet modules set GOPRIVATE=<corporate domain> (bypasses proxy and sumdb automatically).

6. CI — Required

actions/setup-go on GitHub Actions is fine by default, but self-hosted CI in CN must explicitly configure GOPROXY.

How to confirm it works

Dependency fetching works (measured output shape):

GOPROXY=https://goproxy.cn,direct fetching cobra v1.8.1 + pflag took only 2.3s (exit 0, measured)

Reproduction baseline: GOPROXY=https://proxy.golang.org,direct fetching the same versions → dial tcp 142.250.69.177:443: i/o timeout (30s, measured, same as golang/go#63244).

Other environments

Symptom

go get / go mod download / go build (first dependency fetch) fails with:

go: github.com/spf13/cobra@v1.8.1: Get "https://proxy.golang.org/github.com/spf13/cobra/@v/v1.8.1.info": dial tcp 142.250.69.177:443: i/o timeout

Key traits: the IP in the error belongs to Google ranges (142.250.x / 142.251.x / 173.194.x); direct connections to proxy.golang.org from Chinese networks (campus/home, no proxy) almost always time out (golang/go#63244, #34548, #49201, ...); the same machine may work later — network fluctuation, not a code problem.

Same family but different root cause (don't fight the network on this page):

• checksum mismatch (module checksum mismatch) -> the proxy cache is out of sync; run go clean -modcache and download again (mechanism-based);
• no space left on device (download/build stage) -> disk full; under WSL, df showing free space but writes failing means the host drive is full — check df -h /mnt/c first.

Cause

Go's default module proxy proxy.golang.org (and checksum service sum.golang.org) lives on Google infrastructure; direct connections from China are unstable — TCP dial fails with i/o timeout. The domestic public proxy goproxy.cn (Qiniu) is the official docs' recommendation for Chinese users; alternatives: goproxy.io, or internal Athens/nexus.

Solution

1. One-off: GOPROXY=https://goproxy.cn,direct go get ... (direct falls back to the source);
2. Persistent (user level): go env -w GOPROXY=https://goproxy.cn,direct;

also keep GOSUMDB=sum.golang.org (goproxy.cn relays checksums fine; no need to disable it in China).

1. Precedence: environment variable GOPROXY=... (exported in shell/system) > go env -w value > default.

If your shell exports GOPROXY, go env -w will NOT take effect (verified warning: "does not override conflicting OS environment variable") — either change the export location (~/.bashrc / /etc/environment) or use an explicit GOPROXY=... go ....

1. Checksums: if sum.golang.org also times out, use GOSUMDB=sum.golang.google.cn (domestic mirror) instead of GOSUMDB=off (loses supply-chain verification).
2. Private modules: configure GOPRIVATE=your.corp.domain (bypasses proxy and sumdb automatically).
3. CI: actions/setup-go on GitHub Actions is fine by default; self-hosted CI in China needs explicit GOPROXY.

Related canonicals

Read as same root (CN mirror family):

• pip install timeout/slow (same root: mirror family, python side)
• npm install slow/hang (same root: mirror family, node side)
• docker pull fails / mirror (same root: mirror family, container side)
• GitHub direct connection slow/fails (same network root: unstable egress)