lux/evm
2
0
Fork 0
mirror of https://github.com/luxfi/evm.git synced 2026-09-24 00:27:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

build: mark lux-private private, not all of luxfi

Browse Source 
GOPRIVATE switches off the module proxy AND checksum verification together.
Covering github.com/luxfi/* meant every luxfi module was fetched straight from
git and trusted without verification — which is how moved tags got captured into
module caches and served from them indefinitely, making the same commit build on
one machine and fail on another.

Nearly all of luxfi is public and on proxy.golang.org, so it belongs under
normal verification. The private org is lux-private. Twelve luxfi repos are
still private AND still 404 on the proxy; where a repo depends on one it is
listed by name rather than by wildcard, so the exemption matches what actually
needs a direct fetch.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-07-28 16:08:40 -07:00
co-authored by Hanzo Dev
parent a9ab969e40
commit f506b0415c
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ci_setup.sh
+4 -3
View File
@@ -7,10 +7,11 @@ echo "Setting up CI environment..."
echo "Go version:"
go version
# Configure GOPRIVATE for all luxfi packages
# Only genuinely-private modules bypass the proxy: everything else in luxfi is
# public, and GOPRIVATE would disable checksum verification for it.
# shellcheck disable=SC2125 # The asterisk is intentional Go module syntax, not a glob
export GOPRIVATE='github.com/luxfi/*'
export GONOSUMDB='github.com/luxfi/*'
export GOPRIVATE='github.com/lux-private/*'
export GONOSUMDB='github.com/lux-private/*'
# Configure git to use GITHUB_TOKEN for authentication
if [ -n "$GITHUB_TOKEN" ]; then