[Buildroot] [PATCH v2 1/2] package/pkg-golang.mk: make GOPROXY configurable

[Christian Stewart]

Hi Yann,

On Mon, Oct 20, 2025 at 9:34 PM <yann.morin at orange.com> wrote:
> > - Avoid package breakages due to missing module sources
>
> How can sources be missing when fetched "direct"ly?

We had situations where Git tags were force-pushed post-facto causing breakages.

I remember another case as well where Git LFS files were handled
incorrectly leading to breakages.

> Do you have a nesxample of a package where this actually fixes the
> download (barring using s.b.o.) ?

I will leave this to James to answer - not sure.

FWIW I've overridden it to "direct" in my own Buildroot branch as I
still prefer from-Git sources.

> > - Better alignment with upstream Go toolchain defaults
> > - Faster downloads via the proxy compared to direct Git clones
> > - Maintains reproducible builds through Go's module checksum validation
>
> In the past, we observed the reverse: the goproxy had a stale version
> that was not matching the upstream one, so when we tried to vendor a
> package, the hashes would not match. Using "direct" fixed the issue
> (sorry, I can't remember what package that was...)

I think it was the other way around, GOPROXY had the stale version yes,

... but the downstream dependencies of said package also expected the
stale version.

> > The default value from the toolchain can be read with "go env GOPROXY"
>
> I disagree. The default should be the same as the previous setting, that
> is "direct". At least in this patch.
>
> If you want to suggest a change of the default, please do that in a
> separate patch.

Ack

Best regards,
Christian