Understanding go.sum

go.sum records checksums used to verify downloaded module content and module metadata.

When Go resolves external dependencies, checksums may be written to go.sum. Entries attest to a particular module version and its go.mod data. The file is an integrity record, not a definitive list of dependencies or a lockfile in the same sense as some other ecosystems.

go mod tidy reconciles module requirements and checksum entries with the package imports and tests it finds. Commit go.mod and go.sum together when appropriate for your project.

Follow this diagram before executing the example. Check where a value or decision changes what runs next.

See Go Modules Reference: go.sum files.

This example is a complete program. Save it as main.go or paste it into the Go Playground.

Go code

package main

import (
	"crypto/sha256"
	"fmt"
)

func main() {
	data := []byte("module archive bytes")
	digest := sha256.Sum256(data)
	fmt.Printf("Checksum: %x\n", digest[:4])
}

Output

Checksum: 251e479b

The program computes a short hexadecimal preview of a SHA-256 digest. The actual go.sum format and checksum database use their defined module-hash mechanisms; this snippet only demonstrates the purpose of comparing content fingerprints.

• Do not treat go.sum as a list of every imported package.
• Do not arbitrarily delete checksum mismatches; investigate unexpected content changes.

Run go mod tidy in a module that imports an external package and compare go.mod with go.sum.

Tip: Edit the example above, predict the output, and run the modified code to test your reasoning.

You have practiced Understanding go.sum in a small, self-contained program. The important habit is to predict what runs, inspect the actual output and distinguish the language rule from the particular example.

Before continuing, make sure you can explain the program to someone who has not seen it, including the line that changes its result.