> Go modules go even further and add automatic checksum verification per default Cargo lockfiles contain checksums and Cargo has used these for automatic verif

> Go modules go even further and add automatic checksum verification per default Cargo lockfiles contain checksums and Cargo has used these for automatic verification since time immemorial, well before Go implemented their current packaging system. In addition, Go doesn't enforce the use of go.sum files, it's just an optional recommendation: https://go.dev/wiki/Modules#should-i-commit-my-gosum-file-as-well-as-my-gomod-file https://go.dev/wiki/Modules#should-i-commit-my-gosum-file-as... I'm not aware of any mechanism which would place Go's packaging system at the forefront of mitigation implementations as suggested here.