What is a Go module, and what do go.mod and go.sum contain?
Quick Answer
A module is a collection of Go packages versioned and distributed together, defined by a go.mod file at its root. go.mod lists the module's own import path, the minimum Go version it requires, and its direct (and sometimes indirect) dependencies with specific version constraints. go.sum records the cryptographic checksums of every module version in the dependency graph, so go build/go mod download can verify downloaded code hasn't been tampered with or silently changed since it was first fetched. Together, go.mod says what versions you depend on, and go.sum cryptographically pins exactly what those versions' contents must be, which is what makes Go builds reproducible across machines and over time.
Detailed Answer
Modules replaced the old GOPATH-based dependency model, and go.mod/go.sum are the two files that make a module's dependencies explicit and verifiable.
A typical go.mod
module github.com/you/myapp
go 1.22
require (
github.com/gin-gonic/gin v1.9.1
golang.org/x/sync v0.5.0
)
module declares the module's own import path. go 1.22 declares the minimum language version the code requires. require lists direct dependencies and their exact resolved versions.
A snippet of go.sum
github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
github.com/gin-gonic/gin v1.9.1/go.mod h1:ji8BvRH1azfM+SYow9zQ6SZMvR8qOMZHmsCuWR9tTTk=
Each line pins a cryptographic hash for a specific module version's content, and for its go.mod file separately. go build verifies every downloaded module against these hashes, refusing to proceed if anything doesn't match.
Why both files are needed
go.mod alone tells you which versions you want. Without go.sum, nothing verifies that what actually gets downloaded from a proxy, a cache, or a git host is really the same bytes you originally built and tested against. go.sum closes that gap. It protects against a compromised registry or a mutated tag silently swapping in different code under the same version number.
Common commands
go mod init github.com/you/myapp # create a new go.mod
go mod tidy # add missing / remove unused dependencies, update go.sum
go mod download # fetch dependencies into the local module cache
go mod verify # check local cache against go.sum