A cryptographic checksum is a digest computed from dependency data to reveal tampering and preserve reproducible builds. Go records these checksums in go.sum alongside go.mod. section 11.1
Go uses checksums to:
- Verify both a module’s source code and its go.mod file. section 11.1
- Reject modified published versions when their checksums no longer match. section 11.1
- Provide defense in depth through go.sum and sum.golang.org. section 11.1
A go.sum entry
A dependency can have separate checksum records for its source archive and go.mod file, such as github.com/gorilla/mux v1.8.0 h1:… and github.com/gorilla/mux v1.8.0/go.mod h1:…. section 11.1
github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
Inspect concrete go.sum records for a dependency and its go.mod file. section 11.1




