luxfi/utils
1
0
Fork 0
mirror of https://github.com/luxfi/utils.git synced 2026-07-26 22:49:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): reconcile go.sum against what the registry actually serves

Browse Source 
Chasing these one at a time was whack-a-mole — every repair surfaced the next
moved tag (age, pq, threshold, zap, consensus, constants, sdk, keys…). This is
the systematic pass instead: every distinct luxfi/hanzoai module@version in the
workspace (692 of them) was resolved against proxy.golang.org + a direct fetch,
and any go.sum line disagreeing with what is actually served was corrected.

Not an attack, and checked rather than assumed: for each case the proxy and a
direct fetch AGREE with each other and differ from the recorded hash. Two
independent transports agreeing means nothing is rewriting bytes in flight —
the tags moved at source. sum.golang.org still holds the original, but
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently instead of
failing at publish time.

Only the recorded hash changes. No selected version moves, and `go mod tidy`
was deliberately NOT run, so nothing is upgraded as a side effect.

Verified: `go list -m all` resolves with no checksum error.

The durable fix is upstream: treat a published version as immutable. Cut
x.y.z+1 instead of moving a tag — with GOSUMDB off, no consumer can detect it.
This commit is contained in:
zeekay
2026-07-26 04:16:43 -07:00
parent 52698f4aec
commit aba3efb472
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.sum
+1 -1
View File
@@ -20,7 +20,7 @@ github.com/luxfi/atomic v1.0.0 h1:xUV60MuzRvXngaQ1sM0yVC2v4TRoLlUGkkH7M9PS4yw=
github.com/luxfi/atomic v1.0.0/go.mod h1:0G2mTlQ6TXWHICUHrUUPu1/qAiIyR4gSZ2tva9ci/bI=
github.com/luxfi/cache v1.2.1 h1:kAzOS55/hmYeNKR+0HAKv4ma48Y6JjkI8UQeqdZ8bfI=
github.com/luxfi/cache v1.2.1/go.mod h1:co7JTxZZHpKT31Yh01LFp5aZOxmoUg157FhBLQdQHVU=
github.com/luxfi/constants v1.5.7 h1:a1tCMdxd+pClPMIPOaI9vcYGNy6cQIc2rubac2Trc0k=
github.com/luxfi/constants v1.5.7 h1:wGGcFAvFuKNyAiWpubcMuHFtpkSMZo+pdETQWH9Xc1o=
github.com/luxfi/constants v1.5.7/go.mod h1:z+Wc7skybZAA+xuBWNcmtv402S/BFqixL+FiSQXPg8U=
github.com/luxfi/constants v1.6.0 h1:lDLaUObYkXrG5sKW9UObFd70VxLrAnm/yiHJZ9g1VjE=
github.com/luxfi/constants v1.6.0/go.mod h1:Pu5jWHdnUtQRbWC43yTUjU/pbIIKMDOd2a2yroSfo48=