4 ms·

Unlike the ones you mentioned, Go doesn't have a central repository. The go.mod contains references to git repositories or local folders: https://go.dev/doc/mo

Unlike the ones you mentioned, Go doesn't have a central repository. The go.mod contains references to git repositories or local folders: https://go.dev/doc/modules/gomod-ref https://go.dev/doc/modules/gomod-ref Not sure why a proxy is needed.

dharmab 3y ago
It's needed to provide checksums for each module. It also significantly improves performance and prevents a left-pad situation. https://go.dev/blog/module-mirror-launch https://go.dev/blog/module-mirror-launch
- kramerger 3y ago
  These are GIT repositories, they have their own cryptographically unique identifiers. No need to send your data to a third-party to get it confirmed. Maybe I'm missing something, but this whole operation feels like a huge infrastructure paid by Google for something that is not needed.
  - ratorx 3y ago
    > cryptographically unique Git uses SHA1 which is pretty far from cryptographically secure. It’s unlikely that’s the sole reason for having a separate checksum database though.
    - justinclift 3y ago
      Doing some searching around online, it seems like git introduced sha256 support several years ago.
      - dharmab 3y ago
        Only for some local operations- git protocol still uses SHA-1 for compatibility with old clients, and existing SHA-1 objects in old repositories aren't converted.
  - dharmab 3y ago
    Git history can be rewritten or deleted e.g. by the git rebase command. The mirror's checksum DB is independent and prevents your build from breaking or being altered if a dependency is manipulated or deleted. As sibling comment notes, Git's hashes are not secure: https://shattered.it https://shattered.it