Cannot use only go major.minor version

I’m trying to understand why Hugo is forcing a toolchain update, when I run:

hugo --gc --minify -s ./docs

go.mod prior build:


go 1.22

require ( v1.0.0 // indirect v0.7.4-0.20240526173855-857c4e4ca182 // indirect

go.mod after build:


go 1.22.2

toolchain go1.22.3

require ( v1.0.0 // indirect v0.7.4-0.20240526173855-857c4e4ca182 // indirect

One of the modules specifies 1.22.3…

@jmooring I haven’t released that yet, current global-v1.0.0 is using 1.22 version.

Out of curiousity, which version of Go are you running?

$ go version
go version go1.22.3 darwin/arm64

Does this impact the deployment? I’m trying to minimise the repetitive upgrades, and stick with major.minor versioning.

You can try to reproduce the issue, with this test repository I created. Simply change the version from 1.22.3 to 1.22 and run:

hugo --gc --minify -s ./docs

Also, Netlify is complaining about the global/go.mod hash. I’m sure what’s the fix for this.

With your test repository I get the same error:

verifying checksum mismatch
        downloaded: h1:QQk2/AIFUOQIGv0YQivBp1qa9aQeAjHHljwIJCGc1fk=
        go.sum:     h1:ZKVkalB26nUsvakWnA861I8MOZNiXK2DKnoBCPTqjT8=

Maybe you force pushed to

Clear the go.sum file (which has the old checksum) and try again.

Regarding the 1.22 to 1.22.3 bump… I am unable to reproduce that with your test repo. I’m running go version go1.22.3 linux/amd64.

@jmooring I bumped the global module to v1.0.1 to fix a small configuration error. Go is still defined to 1.22. Netlify is still complaining about the hash, but when I run the build locally, I have no errors. I’m puzzled, maybe you shed some light into this. How did you get that error locally? I usually delete both go.mod and go.sum to let them be generated with I import the modules.

My local output:

$ hugo --gc --minify -s ./docs --logLevel debug
Start building sites … 
hugo v0.126.1+extended darwin/arm64 BuildDate=2024-05-15T10:42:34Z VendorInfo=brew

INFO  build:  step process substep collect files 1 files_total 1 pages_total 1 resources_total 0 duration 2.169459ms
INFO  build:  step process duration 2.346584ms
INFO  build:  step assemble duration 1.402416ms
INFO  static: syncing static files to / duration 6.080416ms
WARN  deprecated: .Site.GoogleAnalytics was deprecated in Hugo v0.120.0 and will be removed in a future release. Use .Site.Config.Services.GoogleAnalytics.ID instead.
INFO  deprecated: .Site.IsMultiLingual was deprecated in Hugo v0.124.0 and will be removed in a future release. Use hugo.IsMultilingual instead.
INFO  build:  step render substep pages site en outputFormat html duration 22.682292ms
INFO  build:  step render substep pages site en outputFormat rss duration 836.25µs
INFO  build:  step render pages 8 content 3 duration 25.873583ms
INFO  build:  step postProcess duration 4.208µs
INFO  build:  duration 29.898708ms

                   | EN  
  Pages            |  8  
  Paginator pages  |  0  
  Non-page files   |  0  
  Static files     | 13  
  Processed images |  0  
  Aliases          |  0  
  Cleaned          |  0  

Total in 112 ms

Related to the Go version, as soon as I change go 1.22.3 to go 1.22 in go.mod and run hugo --gc --minify -s ./docs at repo root directory, it changes it back to go 1.22.3. I have no idea where is the issue. Is Hugo caching something in the background?

Again, out of curiosity, how did you install Go?

What do you see when you run these commands?

GOTOOLCHAIN=local go version

Have you read through this to see if anything jumps out at you?

I cloned your test repo and ran hugo --gc --minify -s docs

@jmooring I have a Mac, so I installed Hugo and golang with homebrew.


Well, please do a git pull on main repo branch, it should refresh the global module to v1.0.1. I’m not getting any of the hash errors you mention, on my Mac.

Should I remove the go.sum file from repo, since this is getting generated anyways by build? I think what matters is the go.mod to have the correct modules in pace.

I just deleted the entire repo locally and did a git clone, no errors related to module hash. When I change the Go version from 1.22.3 to 1.22, same bad luck happens, Hugo reverts it back to 1.22.3.

I’m not sure what to tell you. I removed the local copy of your test repo, and then cloned it again:

git clone --recurse-submodules
cd hugo-module/
hugo --gc --minify -s docs


verifying checksum mismatch
	downloaded: h1:QQk2/AIFUOQIGv0YQivBp1qa9aQeAjHHljwIJCGc1fk=
	go.sum:     h1:8vfk0VdWE74VvYV5zdHYpQBp9lO6S/BFuTDVbSfPSVk=

This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

To fix this I clear the go.sum file, then run:

hugo --gc --minify -s docs

No errors, and docs/go.mod looks like:


go 1.22

require ( v1.0.1 // indirect v0.7.4-0.20240526173855-857c4e4ca182 // indirect

The Go version did not change.

@jmooring I did the same thing, except the --recurse-submodules flag, since I don’t have any submodules in that repo. Well, ignoring the go.sum file fixes at least the deployment.

I’m still puzzled by the Go version forced change. Do you have a Mac by any chance?

I’m running Linux. I have no explanation for the version bump that you’re seeing.

BTW, adding go.sum to .gitignore is not the right fix to the checksum problem. There’s a reason the checksum file exists — security.

I see, then I still have a problem. When I deploy the website locally, the file is getting generated with the wrong hash. Mac is still Linux, what is the export GOTOOLCHAIN you have set in your .bash_profile? I just want to replicate your exact environment.

I installed a Go binary. You used Homebrew.

I don’t have one.

I am suspicious that your mod cache might have gotten a bit wonky at some point. Have you tried clearing it with hugo mod clean --all

1 Like

That fixed both issues, I had no idea about this command. Thank you so much, I was going ballistic.

I’m glad everything’s working for you.

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.