Toolchain substitution via project-controlled checksum trust

Checksum bypass in Google's Go command allows attackers to substitute downloaded toolchains via a malicious project and module proxy. The golang.org/toolchain verifier accepts a matching project go.sum entry instead of requiring the canonical checksum database value. Exploitation requires operation inside the attacker-controlled project and use of its malicious proxy during a toolchain download; the substituted toolchain executes in the invoking user's context.