Golang / Golang Internals and Memory Management Interview Questions
How does Go's module system work and what is the role of go.sum?
The Go module system (introduced in Go 1.11, stable in Go 1.13) is the standard dependency management mechanism. A module is a collection of Go packages with a go.mod file at its root that declares the module path, Go version, and dependencies.
// go.mod â describes this module's dependencies module github.com/myorg/myapp go 1.21 require ( github.com/gin-gonic/gin v1.9.1 golang.org/x/sync v0.6.0 ) // go.sum â cryptographic checksums for dependencies // github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg= // github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU= // Key commands: // go mod init github.com/myorg/myapp â create go.mod // go get github.com/pkg/errors@v0.9.1 â add/update a dependency // go mod tidy â remove unused, add missing deps // go mod download â pre-download modules to cache // go mod vendor â copy deps into ./vendor // go list -m all â list all deps (direct + indirect) // Minimum Version Selection (MVS): // Go selects the minimum version of each dependency that satisfies all requirements // This is deterministic and avoids 'dependency hell' // If A requires B>=1.2 and C requires B>=1.5, Go selects B@1.5 (minimum satisfying all) // Replace directive â useful for local development or forking replace github.com/vendor/lib => ../local-lib // Exclude â skip a specific buggy version exclude github.com/vendor/lib v1.2.3
go.sum contains SHA-256 checksums (h1: hashes) for every dependency's source tree and its go.mod file. The Go toolchain verifies these checksums against the checksum database (sum.golang.org) on every download. This provides supply-chain security: a tampered dependency produces a checksum mismatch and the build fails. Commit both go.mod and go.sum to version control.
More Related questions...