go mod verify hashes each module in your local module cache and compares the result with the hash recorded when the module was first downloaded. If nothing changed it prints "all modules verified". It detects tampering with cached files on one machine. It does not tell you whether a dependency is safe or vulnerable.
What it does, step by step
According to the Go modules reference, the command:
- Hashes each module's zip file and its extracted directory in the cache.
- Compares both against the hashes stored when the module was first downloaded.
- Prints "all modules verified" if they match.
- Otherwise reports the changed modules and exits with a non-zero status.
The reference adds a detail people miss: it does not use go.sum to verify module content. It may download go.mod files for minimal version selection and will use go.sum to verify those.
What it covers and what it does not
| Threat | Covered by go mod verify? |
|---|---|
| Cached module files edited after download | Yes |
| A build agent with a poisoned cache | Yes, if the cache hashes are intact |
| A malicious but unchanged release | No |
| A known CVE in a dependency | No |
| A wrong version pulled in by go.mod | No |
The first download is protected by other mechanisms: go.sum entries and the checksum database, which gives every user the same contents for a module version. Verify is the local follow up.
When it earns a place in CI
Most CI jobs start with an empty cache, so verify has little to compare. It pays off where caches persist:
- Shared or long lived build agents.
- Restored caches between pipeline runs.
- Developer laptops after a suspicious package or editor extension incident.
Add a step like this after dependencies download:
go mod download
go mod verify
A failure should stop the job and prompt you to clear the cache and investigate, not to retry until it passes.
Pair it with other checks
Verify answers one narrow question. Combine it with checks that answer the others:
- Review go.sum diffs on every dependency pull request.
- Run a vulnerability scan that uses reachability, such as the Go team's
govulncheck. - Keep the Go toolchain current, since the toolchain itself is downloaded and verified through the same checksum database.
Where Safeguard fits
Safeguard covers the questions verify cannot: SBOM and dependency scanning with reachability analysis, plus policy gates on pull requests. You can start with a free scan.
Quick check
Does go mod verify use go.sum?
Not for module content. It compares against hashes recorded in the module cache at first download, and uses go.sum only for the go.mod files it may fetch.
Does a passing verify mean my dependencies are safe?
No. It only shows cached files were not altered after download.
Sources
Last reviewed: 19 October 2026.
