title: Why do go module versions sometimes need 2 lines in go.sum
body: <p>Why do individual module versions sometimes need 2 lines in <code>go.sum</code>?</p>
  <ul>
  <li>one line is just for the module version (<code>v0.1.1</code> in the example below)</li>
  <li>one line also has <code>/go.mod</code> tacked onto the version (<code>v0.1.1/go/mod</code> in the example below).</li>
  </ul>
  <p>For example:</p>
  <pre><code>github.com/foo/bar v0.1.1 h1:kDgnGXZpvZUi7ym6Rm23yVn3gRqBag+vU6M/wytZR9c=
  github.com/foo/bar v0.1.1/go.mod h1:MZcarCLffCxoj/EF1yhRb4HvOSmCkm5Z8FPmzWrMG+g=
  </code></pre>
  <p>The reason I ask is because sometimes when I <code>go get</code> a package, an indirect dependency will be generated in <code>go.sum</code> with only the second line from the example above, and then the build will fail with <code>410 gone</code> for that package@version. However if I manually <code>go get</code> the indirect dependency, the build no longer fails with <code>410 gone</code>.</p>
  <p>I believe this only happens with private repositories, so I understand it will not play well with sum.golang.org. However, I'd like to figure out if it's possible to avoid getting the 410 in the first place, especially with regards to automated module updates, etc.</p>