[Buildroot] [PATCH v2 1/2] package/pkg-golang.mk: make GOPROXY configurable

[James Hilliard]

On Mon, Oct 20, 2025 at 10:34 PM <yann.morin at orange.com> wrote:
>
> James, All,
>
> On 2025-10-20 16:54 -0600, James Hilliard spake thusly:
> > BR2_GOPROXY now configures the Go module proxy URL used to download Go modules
> > specified in project go.mod and go.sum files. By default, it uses Google's
> > official Go module mirror at proxy.golang.org, falling back to direct downloads
> > if the module is not found in the mirror.
> >
> > This change sets the default GOPROXY value to match Go's built-in default of
> > "https://proxy.golang.org,direct" which provides several benefits:
> >
> > - Avoid package breakages due to missing module sources
>
> How can sources be missing when fetched "direct"ly?

Because non-direct is the golang default and "direct" sources
can disappear randomly.

> Do you have a nesxample of a package where this actually fixes the
> download (barring using s.b.o.) ?

For example the latest tailscale fails without goproxy currently.
https://patchwork.ozlabs.org/project/buildroot/patch/20251020225424.98853-2-james.hilliard1@gmail.com/

> > - Better alignment with upstream Go toolchain defaults
> > - Faster downloads via the proxy compared to direct Git clones
> > - Maintains reproducible builds through Go's module checksum validation
>
> In the past, we observed the reverse: the goproxy had a stale version
> that was not matching the upstream one, so when we tried to vendor a
> package, the hashes would not match. Using "direct" fixed the issue
> (sorry, I can't remember what package that was...)

Weird, virtually all go projects expect the versions from goproxy in cases
where there may be a conflict, I've repeatedly run into this issue, the
manifests/hashes in the package checksum files virtually always match
goproxy versions and not direct versions.

>
> > The default value from the toolchain can be read with "go env GOPROXY"
>
> I disagree. The default should be the same as the previous setting, that
> is "direct". At least in this patch.
>
> If you want to suggest a change of the default, please do that in a
> separate patch.

So goproxy basically has to be the default, otherwise go package
builds relying on goproxy serving stale versions will fail.

Using GOPROXY=direct is kind of a niche use case since the
go ecosystem at large expects the caching proxy to be enabled.

I'll split out the GOPROXY default change.

> Regards,
> Yann E. MORIN.
>
> > We rely on package developers to audit their dependencies in go.mod and go.sum.
> >
> > The value can be configured to:
> > - A comma-separated list of proxy URLs
> > - "off" to disable all downloads
> > - "direct" to download directly from source repositories
> >
> > For more details on Go module proxies:
> > https://go.dev/ref/mod#module-proxy
> >
> > Discussion:
> > https://lore.kernel.org/all/CADvTj4pXO2rwJ8oCzzGNY+OxLuo3uJnDT2PAxbyquw0L6dhfiA@mail.gmail.com/T/#t
> >
> > Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
> > Signed-off-by: Christian Stewart <christian at aperture.us>
> > ---
> > v1 -> v2:
> >
> >  - added more context and links
> >  - renamed to GOPROXY instead of GOPROXY_LIST
> >  - moved into the !BR2_PRIMARY_SITE_ONLY section
> >
> > Signed-off-by: Christian Stewart <christian at aperture.us>
> > ---
> >  Config.in             | 16 ++++++++++++++++
> >  package/pkg-golang.mk |  2 +-
> >  2 files changed, 17 insertions(+), 1 deletion(-)
> >
> > diff --git a/Config.in b/Config.in
> > index d730f2034b..23717f3f97 100644
> > --- a/Config.in
> > +++ b/Config.in
> > @@ -335,6 +335,22 @@ config BR2_LUAROCKS_MIRROR
> >
> >         See http://luarocks.org
> >
> > +config BR2_GOPROXY
> > +     string "Go module proxy"
> > +     default "https://proxy.golang.org,direct"
> > +     depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
> > +     help
> > +       The Go module proxy URL used to download Go modules. By
> > +       default, it uses the official Go module mirror, falling back
> > +       to direct downloads if the module is not found in the mirror.
> > +
> > +       The value can be one of:
> > +         - Comma-separated list of proxy URLs
> > +         - "off" to disable all downloads
> > +         - "direct" to download directly from source repositories
> > +
> > +       See https://go.dev/ref/mod#module-proxy
> > +
> >  config BR2_CPAN_MIRROR
> >       string "CPAN mirror (Perl packages)"
> >       default "https://cpan.metacpan.org"
> > diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
> > index ffd50adecc..3e388cb257 100644
> > --- a/package/pkg-golang.mk
> > +++ b/package/pkg-golang.mk
> > @@ -101,7 +101,7 @@ $(2)_POST_PATCH_HOOKS += $(2)_GEN_GOMOD
> >  $(2)_DOWNLOAD_POST_PROCESS = go
> >  $(2)_DL_ENV += \
> >       $$(HOST_GO_COMMON_ENV) \
> > -     GOPROXY=direct \
> > +     GOPROXY=$$(call qstrip,$$(BR2_GOPROXY)) \
> >       $$($(2)_GO_ENV)
> >
> >  # If building in a sub directory, do the vendoring in there
> > --
> > 2.43.0
> >
> > _______________________________________________
> > buildroot mailing list
> > buildroot at buildroot.org
> > https://lists.buildroot.org/mailman/listinfo/buildroot