From 0ed2a574f47c965795066175d61f0e65d7e1b18b Mon Sep 17 00:00:00 2001 From: zeekay Date: Sun, 26 Jul 2026 04:16:22 -0700 Subject: [PATCH] fix(deps): reconcile go.sum against what the registry actually serves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Chasing these one at a time was whack-a-mole — every repair surfaced the next moved tag (age, pq, threshold, zap, consensus, constants, sdk, keys…). This is the systematic pass instead: every distinct luxfi/hanzoai module@version in the workspace (692 of them) was resolved against proxy.golang.org + a direct fetch, and any go.sum line disagreeing with what is actually served was corrected. Not an attack, and checked rather than assumed: for each case the proxy and a direct fetch AGREE with each other and differ from the recorded hash. Two independent transports agreeing means nothing is rewriting bytes in flight — the tags moved at source. sum.golang.org still holds the original, but GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never consult the checksum DB and a moved tag splits consumers silently instead of failing at publish time. Only the recorded hash changes. No selected version moves, and `go mod tidy` was deliberately NOT run, so nothing is upgraded as a side effect. Verified: `go list -m all` resolves with no checksum error. The durable fix is upstream: treat a published version as immutable. Cut x.y.z+1 instead of moving a tag — with GOSUMDB off, no consumer can detect it. --- go.sum | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.sum b/go.sum index 2939b3b..207ea50 100644 --- a/go.sum +++ b/go.sum @@ -147,7 +147,7 @@ github.com/luxfi/p2p v1.21.1 h1:gmz1JMDhzHIL3dQlhwIDvR4OlFuhNVfnWUl/ipYhAIo= github.com/luxfi/p2p v1.21.1/go.mod h1:SsNPR5fPGWWNem9plGWhSmRqyDoysJ3kPAN0zG0g3iw= github.com/luxfi/pq v1.0.3 h1:ksw1dmfTR0dqqNMRS7BjGcprCO2Fhc+3Iiq2/NMuONw= github.com/luxfi/pq v1.0.3/go.mod h1:8bppZcRElfrVt0n3nYCZW3iX1TvhvzNbdjNdK1irgIE= -github.com/luxfi/precompile v0.5.37 h1:2v0zTZtU3cP/hlCA1602Bz//mK+9jjUkYCBsc3KU67w= +github.com/luxfi/precompile v0.5.37 h1:Yh3dJ+dYuFuzsJgIBRmAJXNsmGEb0BUJN5fzZe3yYeE= github.com/luxfi/precompile v0.5.37/go.mod h1:z1ZLWPKPdZXqIQZOSdVObM8nTIxrblP6a+fqf3O7OHs= github.com/luxfi/runtime v1.1.0 h1:6TrvzAmZVCTVbR1ebntHTO3/kVBaogPUSkxdDMnrTiw= github.com/luxfi/runtime v1.1.0/go.mod h1:Mfv2zlXqvfRFMS+/zXgG1TieyP9VnvtVzOGB437+o4Y=