|
|
|
|
|
|
by theamk
26 days ago
|
|
|
2nd paragraph of blogpost: > A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to prevent repos from being left-pad’d. there is no need for 3rd party hosts to stay online. It's the best combination of de-centralized and centralized approaches. Re pre-buiild packages: Python makes a difference between source and binary wheels. This approach is obviously for source wheels only. |
|
|
I've ran into issues in my very limited go experience with them missing things and having hash mismatches (maybe someone changed a tag and it was working as intended? I don't remember the exact chain of events but I ended up with a hash that could no longer be found anywhere)