3 ms·

From what I understand, the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking on new machines tha

by xena 4y ago

From what I understand, the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking on new machines that don't have it cached locally. Imagine the problems that could happen if someone new joins your team, runs `go build` and then one of the vital dependencies 404s. The other problem is that it's Google so their perception of "not much traffic" is "biblical floods" to other people.

_wolfie_ 4y ago
But that is what should happen. The build should break. So that someone can fix it.
- cp9 4y ago
  the blast radius of that outcome is another leftpad incident. the go team decided that they don't want that to happen
- psanford 4y ago
  Why? If some open source maintainer goes off the rails and deletes all their packages, why should that break my builds? I still have a valid license to the code, I don't really care that a maintainer rage quit 4 dependencies down from my application. I certainly don't want to have to scramble to deal with that.
  - luckylion 4y ago
    Do they change the behavior if the repo was dropped for legal issues, and no valid licenses could have been obtained because the repo owner didn't have one in the first place?
    - psanford 4y ago
      The go proxy won't save modules that don't have a permissive license.
  - dpkirchner 4y ago
    This is an argument for maintaining a local cache of necessary build dependencies, not to rely on a third party.
    - psanford 4y ago
      Before the proxy service that is what people did. Now we don't need to because the proxy service handles that automatically. You can run your own proxy service if you want. There's a large benefit to the go community as a whole for there to be a shared default proxy service.
cesarb 4y ago
> the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking This is a consequence of what IMO is another bad decision by the Go team: having packages be obtained from (and identified by) random github repos, instead of one or more central repositories like Maven Central for Java or crates.io for Rust. The proxy ends up being nothing more than an ad-hoc, informally-specified, bug-ridden re-implementation of half of a central repository, to paraphrase Greenspun's tenth rule.
Macha 4y ago
If they change the case on their username on the other hand, the Go ecosystem explodes: https://github.com/sirupsen/logrus/issues/570#issuecomment-313933276 https://github.com/sirupsen/logrus/issues/570#issuecomment-3...
- MrStonedOne 4y ago
  [dead]

by xena 4y ago

_wolfie_ 4y ago

But that is what should happen. The build should break. So that someone can fix it.

cp9 4y ago
the blast radius of that outcome is another leftpad incident. the go team decided that they don't want that to happen
psanford 4y ago
Why? If some open source maintainer goes off the rails and deletes all their packages, why should that break my builds? I still have a valid license to the code, I don't really care that a maintainer rage quit 4 dependencies down from my application. I certainly don't want to have to scramble to deal with that.
- luckylion 4y ago
  Do they change the behavior if the repo was dropped for legal issues, and no valid licenses could have been obtained because the repo owner didn't have one in the first place?
  - psanford 4y ago
    The go proxy won't save modules that don't have a permissive license.
- dpkirchner 4y ago
  This is an argument for maintaining a local cache of necessary build dependencies, not to rely on a third party.
  - psanford 4y ago
    Before the proxy service that is what people did. Now we don't need to because the proxy service handles that automatically. You can run your own proxy service if you want. There's a large benefit to the go community as a whole for there to be a shared default proxy service.

cesarb 4y ago

> the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking This is a consequence of what IMO is another bad decision by the Go team: having packages be obtained from (and identified by) random github repos, instead of one or more central repositories like Maven Central for Java or crates.io for Rust. The proxy ends up being nothing more than an ad-hoc, informally-specified, bug-ridden re-implementation of half of a central repository, to paraphrase Greenspun's tenth rule.

Macha 4y ago

If they change the case on their username on the other hand, the Go ecosystem explodes: https://github.com/sirupsen/logrus/issues/570#issuecomment-313933276 https://github.com/sirupsen/logrus/issues/570#issuecomment-3...

MrStonedOne 4y ago
[dead]