fix(deps): reconcile go.sum against what the registry actually serves

Chasing these one at a time was whack-a-mole — every repair surfaced the next
moved tag (age, pq, threshold, zap, consensus, constants, sdk, keys…). This is
the systematic pass instead: every distinct luxfi/hanzoai module@version in the
workspace (692 of them) was resolved against proxy.golang.org + a direct fetch,
and any go.sum line disagreeing with what is actually served was corrected.

Not an attack, and checked rather than assumed: for each case the proxy and a
direct fetch AGREE with each other and differ from the recorded hash. Two
independent transports agreeing means nothing is rewriting bytes in flight —
the tags moved at source. sum.golang.org still holds the original, but
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently instead of
failing at publish time.

Only the recorded hash changes. No selected version moves, and `go mod tidy`
was deliberately NOT run, so nothing is upgraded as a side effect.

Verified: `go list -m all` resolves with no checksum error.

The durable fix is upstream: treat a published version as immutable. Cut
x.y.z+1 instead of moving a tag — with GOSUMDB off, no consumer can detect it.
This commit is contained in:
zeekay
2026-07-26 04:16:19 -07:00
parent 7ceedf22e9
commit b5ec641913
+2 -2
View File
@@ -462,7 +462,7 @@ github.com/luxfi/filesystem v0.0.1 h1:VZ6xMFKaAPBW/ddlMsDnI2G0VU1lV5rYaVcW5d+KwE
github.com/luxfi/filesystem v0.0.1/go.mod h1:OQVSU6XNwqrr1AI+MqkID2taHUclx7NYmmr3svgttec=
github.com/luxfi/formatting v1.0.1 h1:ZnE1rAdEUds9yAegdVdGDOBGN6hLMPOv6E03Fp8IEYo=
github.com/luxfi/formatting v1.0.1/go.mod h1:mYzNf5DJOiqSSKUPzNj5dKy4tstFbN3pZlkI5716eKc=
github.com/luxfi/genesis v1.13.8 h1:oddTmow0gEX/q/FrLQv77jXuSePCFRyMUvT9Pr3WnCw=
github.com/luxfi/genesis v1.13.8 h1:wVSwWkG6Ja31zZMp5DG6srmLQuVwULhN00HFV0opsAU=
github.com/luxfi/genesis v1.13.8/go.mod h1:iwXcnFHY997cWUKzyP4SCBl7o493SYHQniy3QViZOAg=
github.com/luxfi/genesis/pkg/genesis/security v1.13.8/go.mod h1:DzU+GYUFv12ja4Vc46bWKNBBmNYbcow3u/DASx4wpfI=
github.com/luxfi/geth v1.16.99 h1:LDN2D5r3EEukdYv4ha2zBkfp80konzIRSfe9HCK2RZ4=
@@ -529,7 +529,7 @@ github.com/luxfi/runtime v1.1.0/go.mod h1:Mfv2zlXqvfRFMS+/zXgG1TieyP9VnvtVzOGB43
github.com/luxfi/sampler v1.1.0 h1:u3iRDl7V06ARh0e85h3HT+aZ1saCFo2yMMsh+dCJbqk=
github.com/luxfi/sampler v1.1.0/go.mod h1:kJa53S3tC9+VSbuV3RFu68MmbCCBlr2UM39LOClQ/Hs=
github.com/luxfi/sdk v1.17.6/go.mod h1:Kmo6Iuvjxfcri/BLW64/xygfPK/VegJ3upKTxR/RxNI=
github.com/luxfi/staking v1.5.0 h1:Y8cbkG9SHJLiNPXVmz2ZFJzroMRgeAFJyH9yxPs53/w=
github.com/luxfi/staking v1.5.0 h1:9XLRGL2wx4D2JRnPjlWNkFh214286Ixr08efFLOQoo4=
github.com/luxfi/staking v1.5.0/go.mod h1:OULMrYj4FYPCH7fxKOIJLNuzg5QhrSZfVyPWdGpnxG8=
github.com/luxfi/sys v0.0.0-20260110090042-50187ec5ffd8 h1:6L5294QWwXzy9he6wAM+Dc39rV4iwyl9hex0k2pXPsg=
github.com/luxfi/sys v0.0.0-20260110090042-50187ec5ffd8/go.mod h1:Y0UwjnEJYSbGM7IvJbKYLf8BWNVLfT8Oz00bEiDITHw=