# go.sum Is Not a Lockfile

DevFeed: [go.sum Is Not a Lockfile](<https://devfeed.tech/articles/go-sum-is-not-a-lockfile-20696.md>)

Original publisher: [Read original article](<https://words.filippo.io/gosum/>)

Author: Filippo Valsorda

Published: 2026-01-05T20:06:30Z

Content type: article

Language: en

Sources: [Filippo Valsorda](<https://devfeed.tech/sources/filippo-valsorda.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [modules](<https://devfeed.tech/topics/modules.md>), [Security](<https://devfeed.tech/topics/security.md>), [supply chain attacks](<https://devfeed.tech/topics/supply-chain-attacks.md>)

Tags: [dependencies](<https://devfeed.tech/tags/dependencies.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [modules](<https://devfeed.tech/tags/modules.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

## AI overview

The article explains that Go's go.sum is a local cache of cryptographic hashes for the Go Checksum Database, not a lockfile and not part of version resolution. It contrasts go.sum with go.mod, which lists the precise dependency versions used to build the main module and its tests.

## Source excerpt

In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.