mirror of
https://github.com/luxfi/dex.git
synced 2026-09-24 00:26:31 +00:00
zeekay
efd4c4c976
The dex Docker builds set GOPRIVATE over our orgs, which routes those module fetches `direct` (git) and bypasses sum.golang.org. After luxfi tags were force-republished (e.g. luxfi/[email protected], luxfi/[email protected]) the git tag content diverged from the immutable proxy/sumdb hash, so a `direct` fetch pulled bits that no longer matched the canonical go.sum — failing image builds with a checksum mismatch (or poisoning go.sum to the moved bits). Resolving through the default public proxy + sumdb yields the canonical immutable hash that matches go.sum and that a re-publish can no longer break — the same model already adopted by lux/kms. Supersedes f6b7ab9 ("GOPRIVATE must cover hanzos3 + all our orgs"): that was a correct interim fix when github.com/hanzoai/vfs and github.com/hanzos3/go-sdk were still private and unreachable through the public proxy. Both are now public and sumdb-verifiable, so GOPRIVATE is no longer needed. Verified by a clean (empty-GOMODCACHE) `go mod download all` with GOPRIVATE empty: every module — including hanzos3/[email protected] and hanzoai/[email protected] (pulled transitively via luxfi/database/zapdb) — fetches and verifies from proxy.golang.org + sum.golang.org. dex pulls no zooai/parsdao/lux-private modules. - Dockerfile, deploy/testnet/Dockerfile: drop `ENV GOPRIVATE=...`. The gh_token BuildKit secret stays only for the cold `direct` fetch fallback. - go.sum: realign luxfi/[email protected] and luxfi/[email protected] h1: hashes to the canonical public sumdb values (`go mod tidy`; `go mod verify` = all modules verified). go.mod unchanged.