Sourcehut will blacklist the Go module mirror

#1

Post by Tomte » Mon, Jan 09, 2023, 2:28 PM UTC

Sourcehut will blacklist the Go module mirror
sourcehut.org

Re: Sourcehut will blacklist the Go module mirror

#2

Post by lwagreputation » Mon, Jan 09, 2023, 2:36 PM UTC

Mhmmm. Yeah I wish the default were to not use a proxy. Though to be fair I'm not sure exactly what the performance implications would be.

Re: Sourcehut will blacklist the Go module mirror

#3

Post by xena » Mon, Jan 09, 2023, 2:49 PM UTC

They should probably use GOPRIVATE[1] instead. GOPRIVATE doesn't disable the module cache globally, it just disables it for individual domains or paths on domains. This is mainly used with private repo dependencies on GitHub.

[1]: https://goproxy.io/docs/GOPRIVATE-env.html

Re: Sourcehut will blacklist the Go module mirror

#4

Post by ddevault » Mon, Jan 09, 2023, 2:59 PM UTC

xena wrote: post #3

They should probably use GOPRIVATE[1] instead. GOPRIVATE doesn't disable the module cache globally, it just disables it for individual domains or paths on domains. This is mainly used with private repo dependencies on GitHub. [1]: https://goproxy.io/docs/GOPRIVATE-env.html

Thanks for the tip, will update the post.

Re: Sourcehut will blacklist the Go module mirror

#5

Post by pantojax45 » Mon, Jan 09, 2023, 3:00 PM UTC

Not a good look for Google here.

Re: Sourcehut will blacklist the Go module mirror

#6

Post by galleywest200 » Mon, Jan 09, 2023, 3:04 PM UTC

> It should not be necessary to fetch the same git module up to 2,000 times per day.

Holy cow Google! Wouldn't it behoove us to check if any changes occurred before downloading an entire repo?

Re: Sourcehut will blacklist the Go module mirror

#7

Post by teeray » Mon, Jan 09, 2023, 3:05 PM UTC

> and implies a trust relationship with Google to return authentic packages.

The entire point of the sumdb (go.sum), is to prevent the need for such a relationship. If Google (or any proxy you use) tries to return questionable packages, it will be detected by that system.

Re: Sourcehut will blacklist the Go module mirror

#8

Post by leetrout » Mon, Jan 09, 2023, 3:05 PM UTC

I feel like Drew has been in a pissing match with the Go team for a while so this outcome doesnt surprise me.

I love Go but not Google's stewardship of it. The tracking proxy, Russ' takeover / squash of the package management work, the weird silence / stonewalling on other community issues...

Drew has a valid complaint. I hate to hear he was banned from the issue tracker but that sounds about right.

As a sibling said - GOPRIVATE is probably a good solution without throwing the baby out with the bathwater.

Re: Sourcehut will blacklist the Go module mirror

#9

Post by xena » Mon, Jan 09, 2023, 3:10 PM UTC

lwagreputation wrote: post #2

Mhmmm. Yeah I wish the default were to not use a proxy. Though to be fair I'm not sure exactly what the performance implications would be.

From what I understand, the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking on new machines that don't have it cached locally. Imagine the problems that could happen if someone new joins your team, runs `go build` and then one of the vital dependencies 404s.

The other problem is that it's Google so their perception of "not much traffic" is "biblical floods" to other people.

Re: Sourcehut will blacklist the Go module mirror

#10

Post by pdonis » Mon, Jan 09, 2023, 3:10 PM UTC

galleywest200 wrote: post #6

> It should not be necessary to fetch the same git module up to 2,000 times per day. Holy cow Google! Wouldn't it behoove us to check if any changes occurred before downloading an entire repo?

I don't understand why they have to do a fresh clone every time.