IssueRaiser

It is not (quite) as bad as it sounds.

It is not (quite) as bad as it sounds. If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get that exact version of the dependency tomorrow when you rebuild (IFF you have version-controlled your go.mod and go.sum, which you should). And if someone tries to be sneaky and move the release tag, the checksum will no longer match, and your build will fail. If you want to upgrade the version of a dependency, that is doable (with plenty of toll assistance), but it requires a positive action. Theer is, however, no good solution for the "first use". But, that is pretyt much standard.

Posted by randomswede on Dec 16, 2020, 12:32 PM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments

reliability (Other)

It is not (quite) as bad as it sounds.

randomswedeDec 16, 2020, 12:32 PM

It is not (quite) as bad as it sounds. If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get that exact version of the dependency tomorrow when you rebuild (IFF you have version-controlled your go.mod and go.sum, which you should). And if someone tries to be sneaky and move the release tag, the checksum will no longer match, and your build will fail. If you want to upgrade the version of a dependency, that is doable (with plenty of toll assistance), but it requires a positive action. Theer is, however, no good solution for the "first use". But, that is pretyt much standard.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue