Re: [go-nuts] Re: Go Module Mirror

Also I don’t see the version hash listed on the package page (browsing in iOS Safari). That would help to compare against the repo for tampering.On Feb 5, 2025, at 9:25 AM, will@gmail.com wrote:Looks like the package is still in the proxy, and sadly is used by one known person.It would be use

[go-nuts] Re: Go Module Mirror

Looks like the package is still in the proxy, and sadly is used by one known person. It would be useful if the proxy site had a tamper warning at the top of a package’s page when the code hash for the version has changed. Perhaps it would be useful to list all the tampered packages in a master

[go-nuts] Re: Go Module Mirror and Checksum Database officially launched!

I'm also excited to share that sum.golang.google.cn is now available to Chinese users as a mirror of sum.golang.org. You can use this service by setting GOSUMDB=sum.golang.google.cn in your local environment. On Thu, Aug 29, 2019 at 2:53 PM Katie Hockman wrote: > Hey Gophers! > > We have excitin

[go-nuts] Re: Go Module Mirror and Checksum Database officially launched!

Very cool! This gopher is definitely excited and will be checking out the related blog post soon :) On Thursday, August 29, 2019 at 1:54:15 PM UTC-5, Katie Hockman wrote: > > Hey Gophers! > > We have exciting news to share. Our module mirror > , index

[go-nuts] Re: Go Module Mirror and Checksum Database in Beta!

Not really. You need the list feature of GOPROXY, which is only available in 1.13 (or tip). > > Is there a way to test proxy.golang.org with go1.12 if we have private > dependencies ? > > -- > William Dodé > > -- You received this message because you are subscribed to the Google Groups "

[go-nuts] Re: Go Module Mirror and Checksum Database in Beta!

On 31-05-2019, Amnon Baron Cohen wrote: > --=_Part_967_922323128.1559316498912 > Content-Type: multipart/alternative; > boundary="=_Part_968_1050003518.1559316498912" > > --=_Part_968_1050003518.1559316498912 > Content-Type: text/plain; charset="UTF-8" > Content-Transfer-Encoding

[go-nuts] Re: Go Module Mirror and Checksum Database in Beta!

See https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md The current behavior is not ideal from a security point of view. So it is good that 1.13 is fixing this. And unless the fix is default, most users will not get the benefit. Anyone who wants to old behavior just needs to set t

[go-nuts] Re: Go Module Mirror and Checksum Database in Beta!

On 30-05-2019, Katie Hockman wrote: > The module mirror at proxy.golang.org serves the go command=E2=80=99s proxy > protocol. The Go 1.13 development tree uses this mirror for all module > downloads by default. See the go command documentation at tip >