liveBook · Manning

Checksum

As explained in Go in Action, Second Edition

A cryptographic checksum is a digest computed from data that can reveal whether the data has changed.

A cryptographic checksum is a digest computed from dependency data to reveal tampering and preserve reproducible builds. Go records these checksums in go.sum alongside go.mod. section 11.1

Go uses checksums to:

  • Verify both a module’s source code and its go.mod file. section 11.1
  • Reject modified published versions when their checksums no longer match. section 11.1
  • Provide defense in depth through go.sum and sum.golang.org. section 11.1

A go.sum entry

A dependency can have separate checksum records for its source archive and go.mod file, such as github.com/gorilla/mux v1.8.0 h1:… and github.com/gorilla/mux v1.8.0/go.mod h1:…. section 11.1

github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=

Inspect concrete go.sum records for a dependency and its go.mod file. section 11.1

How Go in Action, Second Edition covers it

How deep it goes
Explains checksum roles, paired records, verification sources, and version-control practice without detailing digest algorithms.
Examples
Uses go.sum records for github.com/gorilla/mux and the sum.golang.org verification service.
What it assumes
Assumes familiarity with Go modules, go.mod, dependencies, and version control.
What you can do after
Operate/configure Go dependency verification by committing go.sum and maintaining it with go mod tidy.
How it connects
Connects Go modules, go.mod, go.sum, dependency versions, and the checksum database.

Also explained in

Compare how 5 books explain checksum →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Go in Action, Second Edition. The section links point to the parts of the book it draws on.