Hi everyone.

TL;DR: Remove a patch we ship in Go that disables GOPROXY and GOSUMDB and follow upstream defaults, or keep it?

Recently, I had a short conversation in a public forum about two Go features that we modified in Fedora. GOPROXY and GOSUMDB. As I prepare the Fedora 40 and Go 1.22 proposal, it is a great time to discuss it.

You can see the conversation here, I think they bring really good points that we should consider:

https://mas.to/@zekjur/111359951465906642

So first, what are these variables?

• GOPROXY sets the server for fetching module-related information and dependencies.

• GOSUMDB sets the checksum database URL to verify module downloads and ensure their integrity during module resolution.

You can read them more in detail here:

• https://go.dev/ref/mod#environment-variables

• https://go.dev/ref/mod#authenticating

• https://go.dev/ref/mod#module-proxy

There are four approaches as I see this:

1. Keep it the way it is right now.

2. Remove the patch and follow upstream.

3. Create a way to ensure the users know that that option can be changed and leave one of the two previous options as default (by creating two packages, one with the default setting and another that applies the patch).

4. Have a GOPROXY service by Fedora.

1 and 2 are the easiest and most logical ones. 3rd is complex, and I'm not sure it brings any value. 4th would be ideal, but that means maintaining a service with all its costs and time.