The version is specified in the go.mod file. The checksum of the module at that version is saved in the go.sum file. And on initial download the module checksum

The version is specified in the go.mod file. The checksum of the module at that version is saved in the go.sum file. And on initial download the module checksum is validated against a auditable checksum database to verify that it matches the expected value for that module and version. See: https://go.dev/ref/mod#authenticating https://go.dev/ref/mod#authenticating