mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-25 01:35:18 -06:00
Stephan Renatus
8b52a08b74
This extra check is meant to catch go module proxy checksum mismatches, like the one we've released 0.32.1 to fix, earlier. It causes the go mod tooling to fetch all modules from their external sources, most likely all github references, and compares the contents' checksums with what we have in go.sum. It deliberately bypasses the "sumdb" service that is part of the golang infrastructure. The event of a mismatch would happen if a git tag was published, and later changed, and the golang infrastructure's module proxy (and sumdb service) had picked up the first tag. This is rather unlikely, and this test is thus a bit over-cautious. The idea is that if it becomes invisible, it's fine to keep, and gives us a bit of extra safety. However, if it becomes annoying (it's a giant network dependency in our CI runs), it's not critical enough to be kept and is OK to disable again. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>