go-mod

Initialize new module in current directory

$ go mod init [moduleName]

$ go mod download

$ go mod tidy

$ go mod verify

$ go mod vendor

go mod subcommand [arguments...]

init
    Initializes a new module in the current directory, creating a go.mod file.

tidy
    Adds any missing module requirements and removes unused ones, ensuring go.mod and go.sum are accurate.

download
    Downloads the specified modules (or all dependencies if none are specified) into the local module cache.

vendor
    Copies all dependencies into the vendor/ directory within the current module, isolating them from the Go module cache.

graph
    Prints the module dependency graph in text form, showing direct and indirect dependencies.

verify
    Verifies that dependencies in the module cache have not been tampered with by checking their checksums against go.sum.

edit
    Provides command-line editing of go.mod, allowing for adding or removing requirements, or changing the module path.

why
    Explains why specific packages or modules are included in the module graph.

The go mod command is the primary tool for managing dependencies in Go projects, introduced to provide a more robust and reproducible way to handle external libraries compared to the traditional GOPATH model.

It operates around two core files: go.mod, which defines the module's path, required Go version, and its direct dependencies with specific versions; and go.sum, which contains cryptographic checksums for all direct and indirect module dependencies, ensuring integrity and security.

go mod facilitates various dependency management tasks such as initializing a new module, adding or removing dependencies, downloading modules to a local cache, vendoring dependencies, and inspecting the module graph. Its adoption has significantly improved the Go ecosystem's dependency management, making builds more consistent and versioning clearer.

Requires Go version 1.11 or higher; Go 1.14+ made modules the default.
Proper configuration of GOPRIVATE and GONOPROXY environment variables is crucial for managing private or internal modules.
The go.sum file must be committed to version control to ensure reproducible builds and integrity checks.
While go mod vendor can be used, it's generally not required for most Go module workflows as the Go toolchain prioritizes the module cache.

The go.mod file defines the module's identity, Go version, and declared dependencies (with minimum versions or specific versions). The go.sum file provides cryptographic checksums for all direct and indirect dependencies, ensuring their integrity and preventing tampering.

Go modules can utilize module proxies (e.g., proxy.golang.org via GOPROXY environment variable) to fetch modules, offering increased build reliability, security, and speed by serving immutable module versions.

Go modules were introduced as an experimental feature in Go 1.11 (August 2018) to address shortcomings in the traditional GOPATH dependency management system. They became the default and recommended way to manage dependencies starting from Go 1.14 (February 2020). This shift aimed to provide reproducible builds, better dependency versioning, and improved dependency resolution, leading to a more robust and predictable build environment for Go projects.

go(1), go build(1), go get(1), go env(1)