See https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md
The current behavior is not ideal from a security point of view. So it is good that 1.13 is fixing this. And unless the fix is default, most users will not get the benefit. Anyone who wants to old behavior just needs to set two environment vars. On Friday, 31 May 2019 14:15:28 UTC+1, wilk wrote: > > On 30-05-2019, Katie Hockman wrote: > > > The module mirror at proxy.golang.org serves the go command=E2=80=99s > proxy > > protocol. The Go 1.13 development tree uses this mirror for all module > > downloads by default. See the go command documentation at tip > ><https://tip.golang.org/cmd/go/#hdr-Module_downloading_and_verification> > > for details. To make earlier versions of the go command use it (when in > > module mode), set GOPROXY=3Dhttps://proxy.golang.org. > > Could you explain why this option will be default and not opt-in ? > It can break current workflow, for example with private repos. > > Thanks > > -- > William Dodé > > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/d3c61f54-fff3-46c9-8b8d-275686e2def1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
