From 5dfe98636c698a313e980ad8e40024a8a59b6bf3 Mon Sep 17 00:00:00 2001 From: Karl Isenberg Date: Mon, 29 Jun 2026 21:40:44 -0700 Subject: [PATCH] fix(config): default GoBinaryEnvVars to proxy.golang.org, not direct-only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The default GoBinaryEnvVars = ["GOPROXY=direct"] makes Athens' internal `go` subprocess fetch each module from its origin VCS and rebuild the module zip locally. When Athens' bundled Go toolchain differs from the one that produced a module's notarized zip, the rebuilt zip hashes differently, and Athens rejects the *valid* module with a Go "SECURITY ERROR" (checksum mismatch vs sum.golang.org) and serves a 404. This is a recurring, hard-to-diagnose failure for public modules — see #1881, #1080, and #1470. Default to GOPROXY=https://proxy.golang.org,direct instead. The public proxy serves the immutable, notarized zip, whose hash matches sum.golang.org, so the checksum check passes; the ",direct" fallback still resolves modules the proxy doesn't mirror. This matches Go's own default GOPROXY and removes the whole class of toolchain-skew checksum failures. Operators who need origin-only fetches (air-gapped/compliance) can still set GoBinaryEnvVars = ["GOPROXY=direct"] explicitly. Updated config.dev.toml, the testdata fixture, and the corresponding assertions; pkg/config, pkg/middleware, pkg/module, and pkg/download tests pass. Signed-off-by: Karl Isenberg --- config.dev.toml | 2 +- pkg/config/config.go | 2 +- pkg/config/config_test.go | 2 +- pkg/config/testdata/config.dev.toml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config.dev.toml b/config.dev.toml index 07bf403b4..72830c175 100755 --- a/config.dev.toml +++ b/config.dev.toml @@ -43,7 +43,7 @@ GoEnv = "development" # ATHENS_GO_BINARY_ENV_VARS='GODEBUG=true' # Then the final value that the Go binary will receive is ["GODEBUG=true"] and NOT ["GOPROXY=direct", "GODEBUG=true"] # Therefore, whether you use the config file or the env var, make sure you have all the values you need there. -GoBinaryEnvVars = ["GOPROXY=direct"] +GoBinaryEnvVars = ["GOPROXY=https://proxy.golang.org,direct"] # GoGetWorkers specifies how many times you can concurrently # go mod download, this is so that low performance instances diff --git a/pkg/config/config.go b/pkg/config/config.go index 6af93a5a9..dd7d3f3bc 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -149,7 +149,7 @@ func Load(configFile string) (*Config, error) { func defaultConfig() *Config { return &Config{ GoBinary: "go", - GoBinaryEnvVars: EnvList{"GOPROXY=direct"}, + GoBinaryEnvVars: EnvList{"GOPROXY=https://proxy.golang.org,direct"}, GoEnv: "development", GoGetWorkers: 10, ProtocolWorkers: 30, diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index cd2a7e577..7a4198913 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -303,7 +303,7 @@ func TestParseExampleConfig(t *testing.T) { TraceSamplingFraction: 1.0, StatsExporter: "prometheus", SingleFlightType: "memory", - GoBinaryEnvVars: []string{"GOPROXY=direct"}, + GoBinaryEnvVars: []string{"GOPROXY=https://proxy.golang.org,direct"}, SingleFlight: expSingleFlight, SumDBs: []string{"https://sum.golang.org"}, NoSumPatterns: []string{}, diff --git a/pkg/config/testdata/config.dev.toml b/pkg/config/testdata/config.dev.toml index 10d67239c..6160ad403 100755 --- a/pkg/config/testdata/config.dev.toml +++ b/pkg/config/testdata/config.dev.toml @@ -43,7 +43,7 @@ GoEnv = "development" # ATHENS_GO_BINARY_ENV_VARS='GODEBUG=true' # Then the final value that the Go binary will receive is ["GODEBUG=true"] and NOT ["GOPROXY=direct", "GODEBUG=true"] # Therefore, whether you use the config file or the env var, make sure you have all the values you need there. -GoBinaryEnvVars = ["GOPROXY=direct"] +GoBinaryEnvVars = ["GOPROXY=https://proxy.golang.org,direct"] # GoGetWorkers specifies how many times you can concurrently # go mod download, this is so that low performance instances