3 ms·
Or, as mentioned in the post, why they don't do a shallow clone if they have to fetch it every time for whatever reason. Seems like a weird decision either way.
by winterqt 4y ago
Or, as mentioned in the post, why they don't do a shallow clone if they have to fetch it every time for whatever reason. Seems like a weird decision either way.
- mmis1000 4y agoYep, a shallow clone is enough to get the latest version. And you can even filter the tree to make the download size even smaller given you only want the hash but not the contents (if the git server supports this feature) A checkout with this can literally clone nothing but hash git clone --depth=1 --filter=tree:0 --no-checkout https://xxxx/repo.git cd repo git log
- WorldMaker 4y agoPeople using Go modules should be using git tags, right? They should have at least one hash already that should be infinitely cacheable, the tag commit. Of course, I have seen alleged examples of Go modules using tags like branches and force pushing them regularly, but that kind of horror sends shivers down my back, at least, and I don't understand why you'd build an ecosystem supporting that sort of nonsense and which needs to be this paranoid and do full repository clones just for caching tag contents. If anything: lock it down more by requiring tag signatures and throwing errors if a signed tag ever changes. So much of what I read about the Go module ecosystem sounds to me like they want supply chain failures. I don't understand the Go ecosystem.