← Back to Go Course | Chapter 10: Packages & Modules | Lesson 3 of 6

go.mod and go.sum Explained

go.mod is your project's shopping list of ingredients it needs, and go.sum is the receipt proving every ingredient is exactly what it claims to be.

In this page:

  1. What go.mod Contains
  2. What go.sum Contains
  3. Keeping Dependencies Tidy
  4. Why Commit Both Files
Syntax
go 
module module/path

go 1.21

require example.com/pkg v1.2.3

// go.sum: module version hash

What go.mod Contains

go.mod records the module's own import path, the minimum Go version it targets, and a require block listing every direct (and sometimes indirect) dependency with an exact version.

Example: What go.mod Contains

bash 
module github.com/example/myapp

go 1.22

require github.com/some/dependency v1.4.0

⚠️ Run this in your own terminal or Node.js environment.

What go.sum Contains

go.sum stores cryptographic hashes for every dependency's exact content, so that anyone building the project gets bit-for-bit the same code -- protecting against a compromised or accidentally altered package.

Example: What go.sum Contains

bash 
github.com/some/dependency v1.4.0 h1:abcdef1234567890...
github.com/some/dependency v1.4.0/go.mod h1:1234567890abcdef...

⚠️ Run this in your own terminal or Node.js environment.

Keeping Dependencies Tidy

'go mod tidy' scans your source code's actual imports and updates go.mod/go.sum to match exactly -- adding anything missing and removing dependencies that are no longer actually imported anywhere.

Note: Run 'go mod tidy' before committing whenever you add or remove imports.

Example: Keeping Dependencies Tidy

bash 
go mod tidy

⚠️ Run this in your own terminal or Node.js environment.

Why Commit Both Files

Committing go.mod and go.sum together to version control guarantees every developer, and every CI build, resolves dependencies to the exact same versions with verified content -- this is what makes Go builds reproducible.

Example: Why Commit Both Files

markup 
// Every Go file belongs to a package; main builds an executable
package main

// Import the fmt package
import "fmt"

// main is where the program starts running
func main() {
	// Print the values followed by a newline
	fmt.Println("go.mod + go.sum, committed together, make builds reproducible")
}
Related Topics

Go Modules and go.mod · Importing Packages · Creating Your Own Packages · Package Basics

{# common_mistakes/chapter_summary/browser_support: on Hindi pages the view already swaps in the hi_ translation fields (or blanks these out if untranslated), so this renders correctly for both languages without a lang_code check here. #}
Common Mistakes
  1. Editing go.sum by hand -- it's machine-generated and should only be updated by running go commands.
  2. Deleting go.sum thinking it's unnecessary, when it's what protects the build from tampered or corrupted dependencies.
  3. Committing go.mod but forgetting to commit go.sum, breaking reproducible builds for other developers.
Chapter Summary
  • go.mod declares the module's identity, Go version, and its required dependencies with versions.
  • go.sum records cryptographic checksums for every dependency, verifying their integrity.
  • Both files should always be committed to version control together.
  • 'go mod tidy' keeps go.mod and go.sum accurate, adding missing and removing unused requirements.
🔒

Chapter Quiz — Complete all 6 topics to unlock

0/6 topics done

Complete these topics first:

← Previous Lesson Importing Packages Next Lesson → Creating Your Own Packages

Login to run this code

C/C++/Java/PHP execution requires a free account. Your code is saved — you'll land right back in the editor after logging in.