Retracted: v1.36.2 does not name one body of code. proxy.golang.org and sum.golang.org hold the content it was published with and always will, because a published version is immutable to them; GitHub serves something else. Builds through the proxy and builds that go direct therefore disagree, and the direct ones only look fine because GOPRIVATE skips the checksum database — so this is a checksum SECURITY ERROR waiting for the first consumer who builds without it. The answer to a moved tag is a new version, never a re-pointed one. Use v1.36.3 or later.