32-bit
wixmachine scopego.dev · publisher domain- File name
- go1.26.5.windows-386.msi
- SHA-256
- fe20b9d7cc23c9f1afb702a7f04161d75055cd6d58c783d9ad3381e4e83fe9b8
- Product code
- {4FFF969B-44D4-46E5-A73A-589331513BDF}
by https://go.dev · BSD-3-Clause
An open source programming language that makes it simple to build secure, scalable systems.
These URLs are the ones https://go.dev declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what https://go.dev published. Delete it.
Windows · PowerShell
Get-FileHash "go1.26.5.windows-amd64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "go1.26.5.windows-amd64.msi"Expected output
d554dc209403b101225fc2b54647ef47df09bea23291b1246fe1b35198f55f50
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
32-bit · machine scope · MSI convention
msiexec /i "go1.26.5.windows-386.msi" /qn /norestart64-bit · machine scope · MSI convention
msiexec /i "go1.26.5.windows-amd64.msi" /qn /norestartARM64 · machine scope · MSI convention
msiexec /i "go1.26.5.windows-arm64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 32-bit
{4FFF969B-44D4-46E5-A73A-589331513BDF}
Uninstall, with the usual prompts
msiexec /x {4FFF969B-44D4-46E5-A73A-589331513BDF}Silent, for deployment
msiexec /x {4FFF969B-44D4-46E5-A73A-589331513BDF} /qn /norestartProduct code · 64-bit
{5A03BABB-E5C2-4D6F-A462-620263B6D4EE}
Uninstall, with the usual prompts
msiexec /x {5A03BABB-E5C2-4D6F-A462-620263B6D4EE}Silent, for deployment
msiexec /x {5A03BABB-E5C2-4D6F-A462-620263B6D4EE} /qn /norestartProduct code · ARM64
{0DF8951C-91E9-40DB-AE73-E88E9CAB760F}
Uninstall, with the usual prompts
msiexec /x {0DF8951C-91E9-40DB-AE73-E88E9CAB760F}Silent, for deployment
msiexec /x {0DF8951C-91E9-40DB-AE73-E88E9CAB760F} /qn /norestartThe codes above belong to Go Programming Language 1.26.5, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "Go*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | BSD-3-ClauseA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Go Programming Language registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from go.dev, which is a domain we have tied to https://go.dev.
Every one of the 3 installers on this page comes with the SHA-256 https://go.dev declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id GoLang.Go --exactUpgrade later
winget upgrade --id GoLang.GoWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Go Programming Language, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
C61C38054413CCBEF9ACDDC0CAA0ACAAAD49A9858F119A269265A5A18E894E8F
55902C036634C7AB3159CF259AF692ABC86989AAEFCC7F75BEF888F3263031C4
B87863733CD87624387EE61307A5EBAF405351BF4035A3AA7744C26A785A3D3E
762FB2194579BEE625C22E7D1B56E9B8E78413368A924F04BEA1E0D860E01264
3B7C9C236086AC512CF09CB80C4437E18E585145297EABA713A3DACA54709FC6
74CF0A14499B957987F1293E4D4ADABB2788D2D768498A9C9CD68B6EDE487480
9A63074567B8A0A94091E8F6C2096F5D4D0369C7BBAED08158A63004D8B8CAC1
84826ECA833548BB2BEABE7429052EAAEC18FAA902FDE723898D906B42E59A73
F59E0E51370CAC7AB5742C4ED9FC151F0A20918396C893996125A1C6ED7D9525
3CCD657861C32E9552DE83E1ABC88E68DF87ADD99EE068DFB860268A216C15F5
9B1FFB28D6E934BF7683B09B01E1843E9B4BAAB89C119A81DE59B851BD01BF73
1364F07472A3FBDB8683DDE9044ED361EDEA9D36C6FDD08ADE5DD3C5751FEF71
82C87C3562EB6E31548D04E06A48EDC43C94C0306B0A25E314D292DEB964A9E0
CFB446AA6144566F3AAC0E74F8A1B5D7936A2BFCD0EE47CC36AFB0052DB9C872
CBBDC959763B093C89F68443285B85AA902BC37D623B843FA07AEEF523DFEA01
8C9CBFAB99BDC2E4149C58C739CE03A50E2EDCB18477DBC5B69C626C26A9A0EA
C6055334F2A72650E405806234C26BCB4C57911A8F1960DE0C045BB66A732A84
0FB91A797C677696AB2069CC9BCA8EAA28D3D89833077109F8E839F24C055493
672C7E5F64B0457AFC44CF2D6F7633D0C81AEBC46955334A29810BBD40C3FC28
8368BC6E1EEEF015BDA240A1F47F244BE39A3F285C1C6F2A00C155BC3B5C26B3
348C5BB89A7B00FDB535DE8197D5239F91238090D1C493885DC1898B733CFEE0
44870CB1925DBEF808381A13C4737F062879CA467D685910C4B52370986908F4
F10D066ED3CCD7AB3D5D330EAB6BEFC58F3E3DD665A2B5821EE93159AB04BF2F
65172B67924E3B69280E711356D970A8644F7F4C93FCA1307F2F244399DB56E7
F47EEF5731606DC5EF0B59A9A2F7AE90F3B0843F54DC510C1D82900CD9BFA0B5
4C08C06CB12E050B96C7E04B3FA622DE28557F92E130F81106383E761B002652
30D30EE1B3CF268DA4D21F0168A774DDA688A93283CC55DA77F726C0C91D0B04
DFD8F7E534DC2F05627641D2DF9A165C84FB5EE42EB322092C3F3D385A7AA71B
370F08E90693EB9CDD5222351094627FD3BE35A8A9230783573739F783A9482F
435EDE2743FF51AEBF6C9C1C9F38F67372DC2EE855B831B3F9192403B429C37C
960814E5CAA9F90CE95AF62B1CDE19FEE75B7B525F95E69B9F528F126859A158
3F54576FBBF52F8E3B3B879CC00FB9F5B048FB8CA8B51EE6DEFC7418D11A0056
3A606C945D04C7577C44E72AE8146C5583CF985A214BA59FEB69C2E8363C50F7
301952733F5CEEBA1793FE65001BC0CD8D3F1899713E53F5314DBB7C864EBAF4
C9B5057B918862849EF83795AD5ACE4812363CE3877E99863BE759715571DBC1
96211F78B8B0690A898358802D1DD431CA0CD7644F2A6633EE0A2D4174F90BF2
AFD9E0A8D2665FF122C8302BB4A3CE4A5331E4E630DDC388BE1F9238ADFA8FE3
936BD87109DA515F79D80211DE5BC6CBDA071F2CC577F7E6AF1A9E754EA34819
357D030B217FF68E700B6CFC56097BC21AD493BB45B79733A052D112F5031ED9
05FE19D4E04DA8D4A41A72390921EFB70B2D26C9F86EE2C90175C32D0F6A24FB
2894552C0463E7C8C83BFF00ACE4345C71AD8808616EF963DE4DCA9E29E3773F
A89F4DC0020784714728E8F3BCB7549E8B1D068EFA480AE649C8AD124E7CEF72
EEF0329BB25770CE2392C56A70E6074BAFF3C2EC38BB2619A6A199048617563A
3394AB0A830727764B6A576CD84E1FE7640919730B706D42E5948AF35B46CFC8
F236821B94B4DB3FEBC7AB36AC9FC477C14D449FA53EC6DEBB7DBD3C10F9128A
966ECACE1CDBB3497A2B930BDB0F90C3AD32922FA1A7C655B2D4BBEB7E4AC308
0CBB6E83865747DBE69B3D4155F92E88FCF336FF5D70182DBA145E9D7BD3D8F6
47DBE734B6A829DE45654648A7ABCF05BDCEEF5C80E03EA0B208EEEBEF75A852
0D7E7DC0A31BA0CDD487415709D03B02FC9490EF111E8DFD22788A6D63316F37
D5B7637E7E138BE877D96A4501709D480E050D86A8F402BC950E72112B5AEDC5
7EFDE2E5E8468E9CAF2C7FC94F4DA78A726A5031A1ED63ACFF7899527CDDDFF6
8A702D9F7104A15BD935F4191C58C24C0B6389E066B9D5661B93915114A2BEF0
ACEFB191E72FEA0BDB1A3F5F8F6F5AB18B42B3BBCE0C7183F189F25953AFF275
D187BFE539356C39573D2F46766D1D08122B4F33DA00FD14D12485FA9E241FF5
DB128981033AC82A64688A123F631E61297B6B8F52CA913145E57CAA8CE94CC3
5968E7ADCF26E68A54F1CD41AD561275A670A8E2CA5263BC375B524638557DFB
6D352C1F154A102A5B90C480CC64BAB205CCF2681E34E78A3A4D3F1DDFBC81E4
F07677013CD7861C5E16067B0A82144C23C4BF72C139C762E142440F4C926F61
4E78016D889431EB16AA0F87868CF52479B90059791C94A4FF45872D0573089E
4F9780158FB7996DCBCBC7C7EF208F880B5E8C1F2792BA3EDE0C75050C1BC23A
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Go Programming Language version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories https://go.dev and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Go Programming Language — just other entries, each with its own official URL and published hash.