Go Module Mirror and Checksum Database Launched
Vendor. Everything. Always.I appreciate the fact that Google is investing in infrastructure to make the Go ecosystem robust, I really do.Having said that I encourage everyone to do a simple experiment.Check out your code into some random directory. Copy the directory to a USB drive and walk it over to an air gapped machine (no wi-fi, no ethernet, clean dev environment installed). Copy the directory to the box, make some small code change and try to build your binary.If your build fails you're doing it wrong.In real life one of the following will happen[1]:- Your network connection to the Internet will be down- Your network connection to the corporate network will be down- The services you depend on (Github, Google proxy, Docker hub) will be down- The services you depend on will throttle you- The services you depend on will serve you wrong or corrupt data- The services you depend on will be offline for maintenance- The certificates on the service you depend on were not renewed in time- The account you use on services you depend on will be inexplicably suspendedMurphy's law being what it is, some or all of the above will happen when your SaaS is on fire, your customers are screaming, and you're trying to roll out a fix. Meanwhile your company is losing approximately your personal lifetime earnings in revenue every half an hour.Vendor. Everything. Always.(and have backups, lots of backups)[1] Based on highly educational career experience