Go Module Mirror and Checksum Database Launched
Vendor. Everything. Always.<p>I appreciate the fact that Google is investing in infrastructure to make the Go ecosystem robust, I really do.<p>Having said that I encourage everyone to do a simple experiment.<p>Check out your code into some random directory. Copy the directory to a USB drive and walk it over to an air gapped machine (no wi-fi, no ethernet, clean dev environment installed). Copy the directory to the box, make some small code change and try to build your binary.<p>If your build fails you're doing it wrong.<p>In real life one of the following will happen[1]:<p>- Your network connection to the Internet will be down<p>- Your network connection to the corporate network will be down<p>- The services you depend on (Github, Google proxy, Docker hub) will be down<p>- The services you depend on will throttle you<p>- The services you depend on will serve you wrong or corrupt data<p>- The services you depend on will be offline for maintenance<p>- The certificates on the service you depend on were not renewed in time<p>- The account you use on services you depend on will be inexplicably suspended<p>Murphy's law being what it is, some or all of the above will happen when your SaaS is on fire, your customers are screaming, and you're trying to roll out a fix. Meanwhile your company is losing approximately your personal lifetime earnings in revenue every half an hour.<p>Vendor. Everything. Always.<p>(and have backups, lots of backups)<p>[1] Based on highly educational career experience