In this post, I’ll primarily try to explain how dependency management works in Golang and we use various commands and go.mod files to tackle dependencies.
What is go.mod file?
go.mod is the root dependency module for golang projects and all the modules required for the project are present in the file. This means all the projects we are going to import in our projects will be listed in the file.
go mod init github.com/foo/bar we can create a go.mod file which will include the following content –
module github.com/foo/bar
go 1.17
require (
github.com/gin-gonic/gin v1.8.1
github.com/google/uuid v1.3.0
)
require (
github.com/onsi/ginkgo v1.16.5 // indirect
github.com/onsi/gomega v1.24.1 // indirect
)Types of dependencies –
- Direct Dependency – It is the project that our project is directly using in the code.
- Indirect Dependency – It is the module that our project is not using but some other module in our project is using. (e.g. – //indirect in the above go.mod file)
What is go mod tidy?
go mod tidy is the command to ensure that go.mod file has all the project dependencies listed. Also, if there is some dependency listed in the go.mod file that is not used by the project it will remove those.
What is go mod vendor?
So, with go vendor, a vendor directory will be created and all the dependencies will be stored in that directory. So next time instead of downloading from the internet go and take those dependencies from the vendor directory.
What is go.sum? Is it some kind of locking file?
go.mod file contains 100% information to build the project. But, go.sum contains cryptographic checksums to ensure provided module. Typically it contains all checksum for direct & indirect dependencies in a project so that the go.sum file is larger than the go.mod.
If someone clones your repository and they will receive an error if there is a mismatch in their downloaded copies and entries in the go.sum.
So, go.sum is not a lock file it’s an alternative dependency management system.
In addition, go.sum will be used to get local copies of the cache in the system for the further builds present in the $GOPATH/pkg/mod directory.
Aniruddha Basak 