Sourcehut will blacklist the Go module mirror (sourcehut.org)

Article summary

SourceHut was planning to disable access to its git repositories for the Go module mirror due to excessive traffic, but the issue was resolved after discussion with the Go team. The Go team is working on deploying an update to reduce traffic, and automated refresh traffic from the proxy was disabled for SourceHut. This change reduced traffic to an acceptable level, and plans to disable Go traffic were cancelled. The issue highlighted the problem of redundant traffic generated by the Go module mirror.

Main themes

• Go module mirror traffic
• proxy behavior
• security risks
• dependency management
• community communication
• central repository vs proxy
• traffic optimization

What commenters say

• The Go proxy's behavior of fetching modules repeatedly is unnecessary and wasteful.
• The proxy's purpose is to prevent builds from breaking when upstream repositories are deleted or changed.
• The use of a proxy implies a trust relationship with the proxy operator, which could be a security risk.
• A local cache of dependencies is a better solution than relying on a third-party proxy.
• The Go team's decision to use a proxy was a bad idea, and a central repository would be a better solution.
• The proxy's behavior could be improved by using shallow clones or checking for changes before fetching modules.
• The Go team's handling of the issue and communication with the community was inadequate.
• The use of GOPRIVATE is a good solution to disable the proxy for specific domains or paths.