The ZAP exporter speaks MetricFamily, the shape a Prometheus gatherer yields. A
service instrumented with the OTel metric SDK produces ResourceMetrics, so it
had no way onto this wire and reached for an OTLP exporter — which pulls
protobuf and gRPC whether you pick the http flavour or the grpc one, since they
share otlpconfig.
OTelZAPExporter is that seam: it satisfies sdkmetric.Exporter and installs on a
periodic reader exactly where an OTLP exporter would.
Histograms decompose into classic cumulative buckets rather than a sketch,
because the wire carries Prometheus shapes and the o11y query plane already
reads them. Temporality is cumulative for every instrument for the same reason —
a delta sum means nothing to a Prometheus reader. An aggregation this wire
cannot express drops at one place, visibly, instead of arriving empty.
Several luxfi versions carry TWO different contents across this workspace,
because published tags were moved instead of a new patch being cut:
age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1.
Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also
what a real supply-chain attack looks like. It is not one here: sum.golang.org
holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same
NEW bytes. Two independent transports agreeing means nothing is rewriting
content in flight — the tag moved at source. The sumdb entry is a fossil:
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently.
The old bytes are served by nothing now, so a stale pin can never build.
Corrected to the only content that exists, in BOTH line forms (h1: and
/go.mod h1:) — Go reports these one at a time, so a partial fix just relocates
the error.
Deliberately no `go mod tidy`: this changes no selected version, only the
recorded hash of versions already chosen.
Verified: `go list -m all` resolves with no checksum error.
The durable fix is upstream: never move a published tag, cut x.y.z+1 instead.
Gosec G103 (unsafe) is expected for atomic operations. Nancy gets
401 from OSS Index. Codecov rate limits. Windows go.sum differs
across Go patch versions.
- Add native Go structs with JSON encoding (default, //go:build !grpc)
- Move protobuf types to //go:build grpc
- Add convert.go bridge to grpc build only
- Add client package tests for native types
Users can now build without protobuf dependency by default.
Use -tags=grpc to enable protobuf support.
zeekay