Go modules: understanding go.mod and go.sum

Developers unfamiliar with Go modules struggle with adding dependencies, updating versions, and understanding the role of go.sum in reproducible builds.

Key commands and concepts:

# Initialize a module
go mod init github.com/org/repo

# Add a dependency (updates go.mod and go.sum)
go get github.com/some/package@v1.2.3

# Remove unused dependencies
go mod tidy

# Vendor dependencies for offline/reproducible builds
go mod vendor
go build -mod=vendor ./...

# Upgrade all dependencies to latest minor/patch
go get -u ./...

# Show dependency graph
go mod graph

go.mod declares required modules and minimum versions.
go.sum contains expected cryptographic hashes — commit both files.

Go modules use Minimum Version Selection (MVS): the build always uses the minimum version that satisfies all requirements. go.sum prevents supply-chain attacks by verifying downloaded module content against known hashes.