go mod verify: Usage & Common CI Errors

Confirm your cached modules have not been modified.

go mod verify checks that the dependencies stored in the module cache still match the cryptographic hashes recorded in go.sum, catching tampering or corruption.

What it does

Re-hashes each module in the cache and compares against go.sum. On success it prints "all modules verified"; on failure it names the module whose contents changed and exits non-zero.

Common usage

Terminal

go mod verify                     # verify cached modules vs go.sum

Common CI error: a module fails verification

go mod verify reports "example.com/pkg v1.2.3: dir has been modified" because cached source was altered or corrupted. Fix: clear the cache with go clean -modcache, re-download with go mod download, and re-run verify. If it persists, the upstream content changed and go.sum must be investigated, not blindly updated.

Related guides

go mod tidy: Usage, Options & Common CI Errorsgo mod tidy adds missing and removes unused dependencies in go.mod and go.sum. Learn the -go flag and how to… Go "checksum mismatch" - Fix go.sum Verification Errors in CIFix Go "verifying module: checksum mismatch" in CI -- the downloaded module hash does not match go.sum, from… go mod download: Usage, Options & Common CI Errorsgo mod download fetches module dependencies into the module cache. Learn how it speeds up CI, the -x flag, an… go clean: Usage, Options & Common CI Errorsgo clean removes build artifacts and can clear the build and module caches. Learn -cache, -modcache, -testcac…