News for hackers. Stuff that matters.

A comment on How to start a Go project in 2023. Parent comment

Re:How to start a Go project in 2023 by metaltyphoon on Tuesday May 23, 2023 @08:11PM (#36052397)
Not if your default $GOPROXY is google. Google will cache that package indefinitely?
[ Parent | on HN ]
Re:How to start a Go project in 2023 by liggitt on Tuesday May 23, 2023 @10:53PM (#36053511)
That's explicitly not guaranteed. From https://proxy.golang.org:

> Why did a previously available module become unavailable in the mirror? > > proxy.golang.org does not save all modules forever. There are a number of reasons for this…

(I am a googler, but don't work on the go team – my opinions that projects should vendor and actually review their dependencies are my own)

[ Parent | on HN ]
Re:How to start a Go project in 2023 by gwd on Wednesday May 24, 2023 @04:43AM (#36055513)
> proxy.golang.org does not save all modules forever. There are a number of reasons for this, but one reason is if proxy.golang.org is not able to detect a suitable license.

If you're vendoring something without an appropriate license, you're skating on thin ice legally.

[ Parent | on HN ]
Re:How to start a Go project in 2023 by liggitt on Wednesday May 24, 2023 @01:44PM (#36061600)
That's just one possible reason. The disclaimer does not specify all the possible reasons the proxy would drop a saved version. Treating it more like a cache seems appropriate.
[ Parent | on HN ]