Go package management guide for busy developers like myself :)

Soooo I have been working on a project in golang (Yesss I have used AI for it now what to do m***)…. But the point is I have been feeling that I haven’t learnt a new language from a long time. So I decided to learn Golang (after my linkedIN poll ranked it 2nd best to learn in 2026).

Anyway from the start I wanted to talk about the disctinction between Go’s package management solution and how it is different from node_modules and vendor in other frameworks and languages.

To keep the yapping short I will now shut the mouth and get into the details.

0. mental model

• A module = your project (versioned as unit). Defined by go.mod file.
• A package = a folder with .go files (importable code).
• Dependencies are versioned at the module level, not per-package.
• The Go toolchain fetches code and pins versions in go.mod and go.sum .

1. Starting a new module

mkdir hello-go && cd hello-go
go mod init example.com/hello-go

Create main.go

package main
import "fmt"
func main(){
  fmt.Println("hello")
}

Run

go run .

You will now have:

1. go.mod : declaring module path + requirements
2. go.sum : checksums to verify downloaded modules

2. Adding a dependency

I will be adding a popular library now from github.com/google/uuid

go get github.com/google/uuid

Update the main.go

package main
import (
  "fmt"
  "github.com/google/uuid"
)
func main(){
  fmt.Println(uuid.NewString())
}

Run:

go run .

What just happened:

• go getadded a require entry in go.mod
• go.sum got checksums for integrity

3. Other Commands to remember

go mod tidy : Use when you added/removed imports, or CI complains

• adds missing deps
• removes unused deps
• keeps go.mod / go.sum consistent

go list -m all : This is to list what versions am I using?

go get <module>@<version> : pinning or upgrading versions of dependencies

go mod download : prefetching dependencies (good for CI)

go clean -modcache : cleans the corrupted module cache if you want a clean slate

4. Rules in Practice for versioning

You can’t import a package version specifically inside yor project.

import "github.com/google/uuid" imports looks like this while go.mod maintains the versions in require block.

5. Reproducible builds: What to commit

Commit these:

• go.mod
• go.sum
• And your codebase ovbiously

Don’t commit:

• vendor/ unless explicitly required
• module cache (it’s global machine specific)

6. Vendoring (optional but sometimes required)

go mod vendor to build using vendor you use go build -mod=vendor ./... command.

7. Private Repos + Common gotchas

Private modules

Set GOPRIVATE so Go won’t use the public proxy/checksum DB:

go env -w GOPRIVATE=github.com/your-org/*

Proxy Issues

Check the following:

go env GOPROXY GOSUMDB GOPRIVATE

Typical default:

• GOPROXY=https://proxy.golang.org,direct
• GOSUMDB=sum.golang.org

For locked-down networks, you may need an internal proxy.

8. Troubleshooting Checklist

Missing go.sum entry

go mod tidy
go mod download

Module found but does not contain package

• Maybe import path is wrong
• You’re using a module version that doesn’t include that package
• Fix: check module versions and upgrade/downgrade accordingly

go get <module>@<version>

Cannot find module providing package

• type in import
• private repo auth
• network/proxy

Fix: verify import path, set GOPRIVATE , check access.

9. Tiny Practice exercise

1. Create a new module
2. Add two deps: google/uuid & sirupsend/logrus
3. Use them in main.go
4. Run go mod tidy
5. Pin one dependency to a specific version with go get ....@vX.Y.X
6. confirm versions with go list -m all

If you liked this you can subscribe… feel free to reach if you have any project ideas in mind.

https://www.linkedin.com/in/imabbhay/