3 ms·
> the go command may verify the hash If we're talking about reproducible builds, the word "may" seems concerning here?
by gmfawcett 5y ago
> the go command may verify the hash
If we're talking about reproducible builds, the word "may" seems concerning here?
- typical182 5y agoI suspect the primary purpose of the word "may" in that sentence is that you can choose to disable checking the hash against the Certificate Transparency style https://sum.golang.org https://sum.golang.org. In other words, you can opt out. If you do, you fall back to your local go.sum file, which is more-or-less a "TOFU" security model: https://en.wikipedia.org/wiki/Trust_on_first_use https://en.wikipedia.org/wiki/Trust_on_first_use More on sum.golang.org: https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md https://go.googlesource.com/proposal/+/master/design/25530-s...
- gmfawcett 5y agoThank you for the clarification!