How deeply does Go in Action, Second Edition cover go.sum?

Explains the two typical checksum entries and their tamper-detection role, without detailing the checksum algorithm.

Go.sum

As explained in Go in Action, Second Edition

go.sum is a Go module file containing cryptographic checksums for downloaded module dependencies.

A dependency version alone does not record the exact code downloaded for a build. Go pairs go.mod, which records module requirements, with go.sum, which stores cryptographic checksums for downloaded dependencies. Together they support auditable, reproducible builds. section 1.6 section 11.1

github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=

The two entries for github.com/gorilla/mux v1.8.0 record separate h1: checksums for the module source and its go.mod file. section 11.1

Use go get to add a dependency at the latest or a specified version, or add an import and run go mod tidy. Go maintains go.sum alongside go.mod. If a published dependency changes, its checksum no longer matches the recorded value, helping detect tampering. section 11.1

How Go in Action, Second Edition covers it

liveBook manning.com

Read Go in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

go mod tidyproduced by · go mod tidy is a Go command that synchronizes declared module dependencies and checksums with the packages imported by the source code.
reproducible buildconfigures · A reproducible build is a build process that yields the same software artifacts when repeated with the same source and build inputs under equivalent conditions.

This explainer was generated by Manning's knowledge graph from the text of Go in Action, Second Edition. The section links point to the parts of the book it draws on.