See the commit message in the patch file for details:
This sets the default value of GOPROXY=direct and GOSUMDB=off, which causes Go to fetch modules directly from the appropriate version control system instead of fetching via Google-operated servers. This improves the privacy of the downstream Go toolchain.
This may cause some issues for users:
- The Go proxy will cache dependencies whose upstreams have disappeared, for instance due to a deleted git tag. This can cause some Go programs with broken dependencies to build with the Go proxy, but not without. However, the proxy does not cache packages forever, and eventually the error will arise regardless.
- By default, only Git and Mercurial modules will be fetched when using
GOPROXY=direct, whereas all version control systems are supported by
the proxy. Go packages which do not use Git or Mercurial are rare.
The user may configure GOVCS (see
go help vcs) to enable additional version control systems.