Enabling GOPROXY and GOSUMDB in Fedora

[Alejandro Saez Morollon]

Hi everyone.

TL;DR: Remove a patch we ship in Go that disables GOPROXY and GOSUMDB and
follow upstream defaults, or keep it?

Recently, I had a short conversation in a public forum about two Go
features that we modified in Fedora. GOPROXY and GOSUMDB. As I prepare the
Fedora 40 and Go 1.22 proposal, it is a great time to discuss it.

You can see the conversation here, I think they bring really good points
that we should consider:

https://mas.to/@zekjur/111359951465906642

So first, what are these variables?

   -

   GOPROXY sets the server for fetching module-related information and
   dependencies.
   -

   GOSUMDB sets the checksum database URL to verify module downloads and
   ensure their integrity during module resolution.


You can read them more in detail here:

   -

   https://go.dev/ref/mod#environment-variables
   -

   https://go.dev/ref/mod#authenticating
   -

   https://go.dev/ref/mod#module-proxy


There are four approaches as I see this:

   1.

   Keep it the way it is right now.
   2.

   Remove the patch and follow upstream.
   3.

   Create a way to ensure the users know that that option can be changed
   and leave one of the two previous options as default (by creating two
   packages, one with the default setting and another that applies the patch).
   4.

   Have a GOPROXY service by Fedora.


1 and 2 are the easiest and most logical ones. 3rd is complex, and I'm not
sure it brings any value. 4th would be ideal, but that means maintaining a
service with all its costs and time.