3 ms·
While admittedly I'm totally unfamiliar with Go package management, it's notable that the "shared" library reference in that link is un-versioned. It uses a pse
by jiggawatts 3y ago
While admittedly I'm totally unfamiliar with Go package management, it's notable that the "shared" library reference in that link is un-versioned. It uses a pseudo-version of "v0.0.0-00010101000000-000000000000".
If I understand the sibling comment by the author[1] correctly, then the versioning of the "shared" module is via Git submodules, which point at a specific commit hash.
The only issue is that changes to submodule commit hashes are a little more difficult to audit, because they're embedded in the git repo files instead of the source code.
[1] https://news.ycombinator.com/item?id=38596700 https://news.ycombinator.com/item?id=38596700
- teeray 3y agoWhen used out-of-the-box, go.sum is what provides the cryptographic guarantees of the contents of modules retrieved using go.mod. There’s a distributed log system akin to the TLS certificate transparency log that hardens the system against the kinds of substitution you’ve referred to. You can read more about it here: https://sum.golang.org/ https://sum.golang.org/
- oefrha 3y agoYou only looked at the pseudo version and missed the important replace directives replace github.com/candiddev/shared => ./shared replace github.com/google/go-jsonnet => github.com/thequailman/go-jsonnet v0.0.0-20230924031349-110b4ca1dc1a The replacement with ./shared means it's using exactly the version on disk (which is in a submodule here). The go-jsonnet replacement points to a specific commit.