go.sum and dependencies

Learn to add dependencies with go get and the go.sum file.

go.sum and dependencies

To add a dependency, run go get github.com/oguz/hello. This downloads the package, adds a require line to go.mod and writes a hash to go.sum.

The go.sum file holds the cryptographic hash of each dependency. This guarantees the downloaded package has not been tampered with.

To clean up dependencies, use go mod tidy; it removes unused ones and adds missing ones.

go mod tidy

Over time, go.mod and go.sum may fill with unused lines. The go mod tidy command cleans these files: it removes unused dependencies and adds missing ones.

The command scans the code, finds which dependencies are actually used, and updates the files accordingly. It is often run in CI pipelines.

To add a new dependency, go get is usually enough; tidy is more about cleanup.

Exercise The require line

After go get, the line require github.com/oguz/hello v1.2.0 is added to go.mod. Split this line with strings.Fields and print the package path and version on one line.

Show example solution

package main

import (
    "fmt"
    "strings"
)

func main() {
    p := strings.Fields("require github.com/oguz/hello v1.2.0")
    fmt.Println(p[1], p[2])
}

Test yourself

What does the go.sum file store?
- The module path
- Source code
- Test results
- Dependency hashes
Show answer

Dependency hashes — go.sum stores dependency hashes.

Adding a dependency

To add a dependency:
____ get github.com/x/y

Show answer

To add a dependency:
go get github.com/x/y

Match the module commands

go get

Downloads dependency
go mod tidy

Cleans up
go mod init

Starts module
go build

Produces binary

Next lesson: Summary - Modules

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies