Yes. The go command stores downloaded modules in the module cache, and files and directories there are read only so tests and editors cannot change them by accident. Clear it with go clean using the modcache flag, which works whether or not modcacherw was used.
What the cache is for
The Go modules reference says GOPATH still stores downloaded dependencies in its pkg/mod directory, called the module cache, and installed commands in GOPATH/bin unless configured otherwise. When the go command downloads a module, it computes a hash and compares it with go.sum before putting the file in the cache. A file that fails the check is not installed.
So the cache holds content that already passed a hash check against your go.sum or the checksum database.
Why read only matters
The go command documentation says the module cache is read only to prevent tests and editors from modifying files accidentally. That protects a property you rely on: a module version in the cache matches what was verified.
A tool or test that edits a file in the cache would change what later builds compile, without any change to go.mod or go.sum. The go mod verify command exists to detect that. We cover its limits in what go mod verify checks and misses.
The modcacherw flag
The reference describes a flag that creates new directories in the cache with read write permissions instead of read only. Set consistently, for example through GOFLAGS, it lets ordinary tools such as rm delete the cache. Without it, you use go clean -modcache.
Be careful with that setting on shared or CI machines. It trades a safety property for convenience.
When to clear the cache
| Situation | Clear it? |
|---|---|
| A security error you cannot explain | Yes, after investigating, to force a clean fetch |
| Disk is full on a build agent | Yes |
| Routine builds | No, the cache saves time and bandwidth |
| After tampering is suspected | Yes, and treat it as an incident |
Clearing does not fix a problem by itself. If a fresh download fails the hash check again, the issue is upstream or in go.sum, as in Go says SECURITY ERROR on a checksum mismatch.
CI practices
- Restore the cache by a key made from go.sum, so a change in dependencies invalidates it.
- Do not share a writable cache between untrusted jobs.
- Run
go mod verifyas a step after restoring the cache. - Occasionally build with an empty cache, to prove your go.sum is complete.
Safeguard's dependency scanning and SBOM generation record the versions you build from your Go manifests. Try the free scan at gold.safeguard.sh/scan.
Quick check
Where does Go keep downloaded modules?
In the module cache, by default under GOPATH in the pkg/mod directory.
How do I delete the cache if it is read only?
Use go clean with the modcache flag. The documentation says it works whether or not modcacherw was used.
Sources
Last reviewed: 19 October 2026.
