3 ms·
It is not (quite) as bad as it sounds. If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get t
by randomswede 6y ago
It is not (quite) as bad as it sounds.
If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get that exact version of the dependency tomorrow when you rebuild (IFF you have version-controlled your go.mod and go.sum, which you should). And if someone tries to be sneaky and move the release tag, the checksum will no longer match, and your build will fail.
If you want to upgrade the version of a dependency, that is doable (with plenty of toll assistance), but it requires a positive action.
Theer is, however, no good solution for the "first use". But, that is pretyt much standard.
- Macha 6y agoThe left-pad issue is about the package being gone, not modified. Without a cache of your own, there's nothing to prevent that?
- randomswede 6y agoThat is probably to some extent correct. Although this would bite you on a new build, not for anything that is already running in production. My understanding is that that is/was not necessarily the case for leftpad.