News for hackers. Stuff that matters.

A comment on Vulnerability Management for Go. Parent comment

Re:Vulnerability Management for Go by ainar-g on Tuesday September 06, 2022 @12:08PM (#32739111)
It's not a lockfile. It contains hashes of packages so that you could fetch them from any proxy and not worry about proxies doing funny business.
[ Parent | on HN ]
Re:Vulnerability Management for Go by jrockway on Tuesday September 06, 2022 @12:22PM (#32739336)
Even ignoring proxies, it ensures that you have the same code that you started developing with. If you're depending on a tagged Git repository, for example, someone can just force push the tags and change what commit go.mod is actually pointing at. With go.sum, you're guaranteed to be notified that that happened.
[ Parent | on HN ]
Re:Vulnerability Management for Go by svnpenn on Tuesday September 06, 2022 @01:01PM (#32739912)
great point. I am glad they took this into consideration.
[ Parent | on HN ]