3 ms·

it's a known issue https://github.com/golang/go/issues/31866 https://github.com/golang/go/issues/31866

• yjftsjthsd-h 2y ago
  That fix would help with accidents, but wouldn't someone intentionally hoping doing it just add a .mod and .go file to the root?
  • jerf 2y ago
    How do you "fix" that at all? In the end, there is no definition of "a source control repository that is a Go module" that is robust to this sort of "attack"... although calling it an "attack" is kind of dubious, the reasons why this is a bad thing strike me as very strained and relatively weak. Mostly it hurts Google by hosting too much stuff, but, good luck bringing them down that way.
• oooyay 2y ago
  Color me unsurprised Marwan is on this issue. He and Aaron wrote Athens, Marwan wrote (to my knowledge) the first Go download protocol implementation that Athens is based on. This issue is kind of curious because Athens already uses the go mod download -json command mentioned as a preflight check for module verification. More or less, if the repo passes the go module commands understanding of a module then Athens will serve it. In more verboten terms: - a module version, pseudo version, or +incompatible must be able to be formulated - that module (and it's dependencies) must produce a valid checksum The checksum of modules just has to do with the current .mod and all files + recursively for each dependency. So, as the author pointed out you can have lots of space for arbitrary files by design so long as you have a basic go program.