Skip to content

RFC: community/go: disable GOPROXY and GOSUMDB

Drew DeVault requested to merge ddevault/aports:master into master

See the commit message in the patch file for details:

This sets the default value of GOPROXY=direct and GOSUMDB=off, which causes Go to fetch modules directly from the appropriate version control system instead of fetching via Google-operated servers. This improves the privacy of the downstream Go toolchain.

This may cause some issues for users:

  1. The Go proxy will cache dependencies whose upstreams have disappeared, for instance due to a deleted git tag. This can cause some Go programs with broken dependencies to build with the Go proxy, but not without. However, the proxy does not cache packages forever, and eventually the error will arise regardless.
  2. By default, only Git and Mercurial modules will be fetched when using GOPROXY=direct, whereas all version control systems are supported by the proxy. Go packages which do not use Git or Mercurial are rare. The user may configure GOVCS (see go help vcs) to enable additional version control systems.

Merge request reports