fix(deps): reconcile go.sum against what the registry actually serves

Chasing these one at a time was whack-a-mole — every repair surfaced the next
moved tag (age, pq, threshold, zap, consensus, constants, sdk, keys…). This is
the systematic pass instead: every distinct luxfi/hanzoai module@version in the
workspace (692 of them) was resolved against proxy.golang.org + a direct fetch,
and any go.sum line disagreeing with what is actually served was corrected.

Not an attack, and checked rather than assumed: for each case the proxy and a
direct fetch AGREE with each other and differ from the recorded hash. Two
independent transports agreeing means nothing is rewriting bytes in flight —
the tags moved at source. sum.golang.org still holds the original, but
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently instead of
failing at publish time.

Only the recorded hash changes. No selected version moves, and `go mod tidy`
was deliberately NOT run, so nothing is upgraded as a side effect.

Verified: `go list -m all` resolves with no checksum error.

The durable fix is upstream: treat a published version as immutable. Cut
x.y.z+1 instead of moving a tag — with GOSUMDB off, no consumer can detect it.
This commit is contained in:
zeekay
2026-07-26 04:16:47 -07:00
parent 9f4feee450
commit 8a24797625
+2 -2
View File
@@ -11,8 +11,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/luxfi/lattice/v6 v6.1.2 h1:OuNEDkgwiZpe3W6oR7vvSDfLK5jf93y2dNiMj1R9oyA=
github.com/luxfi/lattice/v6 v6.1.2/go.mod h1:vzyXgtFe/itUmSyCRv6pHk9OHW52UkCFTJQiBE5lxBw=
github.com/luxfi/mlx v0.29.4 h1:9bxB7UWKpk8ORCaKjKUrtTC/tJElmMwX4olN0I/qBBE=
github.com/luxfi/mlx v0.29.4/go.mod h1:kEVRkGQ9iQkg+fJtEE3uZr4ANnoI2xvdhsJKk+DAEsI=
github.com/luxfi/mlx v0.29.4 h1:WKPCxKSR+fCYcmfQ4iLNRcEuzTUPlhJYkdO7QQirV9I=
github.com/luxfi/mlx v0.29.4/go.mod h1:59oTAZLQ9J6RCWTaapX1zzCxejb/q84ZqnjURPQGO5o=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=