lux/consensus
2
0
Fork 0
mirror of https://github.com/luxfi/consensus.git synced 2026-09-24 00:26:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Retract v1.36.2

Browse Source 
It does not name one body of code: the proxy and the checksum database hold
what it was published with and always will, and GitHub serves something
else. Builds through the proxy and builds that go direct disagree, and the
direct ones only look fine because GOPRIVATE skips the checksum database —
a checksum SECURITY ERROR waiting for the first consumer who builds without
it. Five repositories hit it before it was traced.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-09-17 21:08:23 -07:00
co-authored by Hanzo Dev
parent 230d2b8e26
commit 44d2c25959
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+11
View File
@@ -165,3 +165,14 @@ exclude google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824
// so CI can fetch modules from proxy.golang.org without sibling clones.
// See CROSS-REPO-VERSION-PIN.md for the SHA → tag mapping at the
// March 3, 2026 PQ Consensus Architecture Freeze.
// v1.36.2 does not name one body of code. proxy.golang.org and sum.golang.org
// hold the content it was published with and always will, because a published
// version is immutable to them; GitHub serves something else. Builds through
// the proxy and builds that go direct therefore disagree, and the direct ones
// only look fine because GOPRIVATE skips the checksum database — so this is a
// checksum SECURITY ERROR waiting for the first consumer who builds without it.
//
// The answer to a moved tag is a new version, never a re-pointed one. Use
// v1.36.3 or later.
retract v1.36.2