Fix Go Error: "missing go.sum entry for module providing package" (2026)

Go error: "missing go.sum entry for module providing package"

The immediate fix: run go mod tidy at the root of your module.

go mod tidy

Then commit the updated go.mod and go.sum. Your build and your CI pipeline will pass again.

The Full Error Text

go: downloading github.com/google/uuid v1.6.0
main.go:7:2: missing go.sum entry for module providing package github.com/google/uuid; to add:
        go mod tidy

The message names the package that your code imports. It also prints the exact command that resolves the problem.

What Causes This Error

Go checks every downloaded module against cryptographic hashes in go.sum. The build fails when go.sum holds no hash for a module that the build needs.

Three situations produce this state:

You added an import to your code, but you did not update go.mod and go.sum yet.
A merge conflict or a manual edit dropped lines from go.sum, so the file diverges from go.mod.
A fresh clone has go.mod in git, but go.sum was never committed.

Since Go 1.16, builds run in readonly mode by default. The toolchain refuses to touch go.mod or go.sum during a plain build, so it stops with this error instead of a silent fix. The Go module reference documents this behavior in the section on -mod=readonly.

Fix 1: Run go mod tidy

go mod tidy reads every package in your module. It writes a require line into go.mod for each import path, and it appends the hashes that match to go.sum.

go mod tidy
go build ./...

Commit both files together, because they describe one dependency state:

git add go.mod go.sum
git commit -m "tidy: add uuid dependency"

For a full walkthrough of the command, read our go mod tidy guide.

Fix 2: Add One Module With go get

Sometimes you want to add one dependency without a full pass over the source tree. go get handles a single module:

go get github.com/google/uuid

The command updates go.mod and go.sum for that module only.

The GOFLAGS=-mod=mod Caveat

The environment variable GOFLAGS=-mod=mod lets ordinary builds update go.mod and go.sum on the fly:

GOFLAGS=-mod=mod go build ./...

Treat this as a local convenience, not a solution. Your CI pipeline starts in readonly mode, and it fails again whenever go.sum is absent from the repository. The durable fix stays go mod tidy plus a commit of both files.

When go.mod and go.sum Diverge

An inconsistent pair of files produces a cousin of this error:

go: github.com/google/[email protected]: missing go.sum entry; to add it:
        go mod download github.com/google/uuid

Typical causes:

A merge resolved go.mod but left go.sum at its old state
Someone edited go.mod by hand
A script rewrote one file but not the other

go mod tidy reconciles the pair in one step. If tidy fails with a network message, check whether your firewall or proxy blocks proxy.golang.org, then review GOPROXY in the module reference.

Vendor Mode Interaction

When a vendor/ directory exists and your go directive is 1.14 or higher, the build loads packages from vendor/ and skips go.sum entirely. The error then changes shape:

go: inconsistent vendoring (or broken go.mod):
github.com/google/[email protected]: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt.

In this state, go mod tidy alone is not enough. Refresh the vendor tree and commit it:

go mod tidy
go mod vendor

If you prefer builds against the module cache instead of the vendor tree, pass -mod=mod explicitly, because vendor mode wins by default once the directory exists.

FAQ

Why does the error mention a package but not a module?

Import paths point at packages. Hashes live per module. Go resolves each package to its parent module first. Then it checks the hash for that module.

Is go.sum a lockfile?

It is close to one, but it stores only hashes, not versions. Versions live in go.mod; go.sum proves that downloads match what the author recorded.