3 ms·
2nd paragraph of blogpost: > A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to
by theamk 3mo ago
2nd paragraph of blogpost:
> A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to prevent repos from being left-pad’d.
there is no need for 3rd party hosts to stay online. It's the best combination of de-centralized and centralized approaches.
Re pre-buiild packages: Python makes a difference between source and binary wheels. This approach is obviously for source wheels only.
- nijave 3mo agoProxies are still 3rd party hosts. I've ran into issues in my very limited go experience with them missing things and having hash mismatches (maybe someone changed a tag and it was working as intended? I don't remember the exact chain of events but I ended up with a hash that could no longer be found anywhere)