Extremely happy to see https://sourcespotter.com, a Go Checksum Database monitor and Go toolchain reproducer by @agwa.
These use the transparency logs we built into the Go supply chain to keep the Google-operated services honest.
You can check your local view of the sumdb matches Source Spotter's with this command:
curl --data-binary "@$(go env GOPATH)/pkg/sumdb/sum.golang.org/latest" https://gossip.api.sourcespotter.com/sum.golang.org
