Go Module Proxy: Life of a Query

on YouTube ↗38m

" summary

Go modules get reproducible builds via minimal version selection, dependency fetches go through a configurable HTTP proxy (default proxy.golang.org), and a global checksum database provides signed tree heads and inclusion/consistency proofs so every client verifies sha256 gosum lines before trusting a module. The system uses a Merkle log backed by Trillian, tiles (client caches every 8th level) for proofs, and ships by default in Go 1.13 with proxy/comma-list and GOPRIVATE controls.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 3:14Solving build reproducibility
3. 6:45Module proxies and caching
4. 13:49Trusting source code
5. 20:10Transparent checksum database
6. 31:33Go 1.13 features
7. 34:05Q&A

" related talks

• 33mHow to Safely and Efficiently Build your App with ModulesAaron Schlesinger · GoWayFest 4.0 (online edition)
• 17mPackage Management in Go: Under the HoodGilad Weiss · GopherCon Europe 2022
• 31m"The Athens Project - A Proxy Server for Go Modules"Aaron Schlesinger · GothamGo 2019
• 07mSecurity of Go Modules and Vulnerability Scanning in GoCenterDeep Datta · GopherCon Europe 2020
• 31mBring Sanity to your DependenciesAaron Schlesinger · Gopherpalooza 2018
• 24m"Finding Dependable Go Packages"Julie Qiu · GothamGo 2019
• 07mBuilding A Central Go Modules RepositoryAnkush Chadha · GopherCon 2019
• 26mFinding Dependable Go PackagesJulie Qiu · GopherCon UK 2019