3 ms·
Why do you need a proxy to fetch the modules in the first place? It seems a little odd for a package manager.
by onei 7y ago
Why do you need a proxy to fetch the modules in the first place? It seems a little odd for a package manager.
- mfer 7y agoThe jFrog folks provided a good example with GoCenter. It was optimized for the performance use case. If you used their proxy, released at the end of last year I think, the time to pull a dependency was significantly less than to pull it from GitHub. This leads to things like faster CI builds.
- onei 7y agoAh, that makes more sense. I was imagining it as a routing thing rather than caching the packages.
- DuskStar 7y agoAlso, the dependency resolution really just relies on `go.mod` and `go.sum` - having to download the entire git tree just to access different versions of those files is a bit inefficient. (It also makes it harder for 3rd parties to serve different versions of a dependency to different people - and easier for Google to do the same)
- matahwoosh 7y agoIt's so that you can have a seamless module version checksum [1]. The checksum in proxy ensures that you don't "trust on first use" whenever you update a module. [1] https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md https://go.googlesource.com/proposal/+/master/design/25530-s...
- sangnoir 7y agoWrite-only caches are a good way to avoid left-pad-type debacles[1] 1. https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/