{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/25525","repository_url":"https://api.github.com/repos/golang/go","labels_url":"https://api.github.com/repos/golang/go/issues/25525/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/25525/comments","events_url":"https://api.github.com/repos/golang/go/issues/25525/events","html_url":"https://github.com/golang/go/issues/25525","id":325826498,"node_id":"MDU6SXNzdWUzMjU4MjY0OTg=","number":25525,"title":"x/vgo: rename go.modverify to go.sum and enable by default","user":{"login":"FiloSottile","id":1225294,"node_id":"MDQ6VXNlcjEyMjUyOTQ=","avatar_url":"https://avatars1.githubusercontent.com/u/1225294?v=4","gravatar_id":"","url":"https://api.github.com/users/FiloSottile","html_url":"https://github.com/FiloSottile","followers_url":"https://api.github.com/users/FiloSottile/followers","following_url":"https://api.github.com/users/FiloSottile/following{/other_user}","gists_url":"https://api.github.com/users/FiloSottile/gists{/gist_id}","starred_url":"https://api.github.com/users/FiloSottile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FiloSottile/subscriptions","organizations_url":"https://api.github.com/users/FiloSottile/orgs","repos_url":"https://api.github.com/users/FiloSottile/repos","events_url":"https://api.github.com/users/FiloSottile/events{/privacy}","received_events_url":"https://api.github.com/users/FiloSottile/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"rsc","id":104030,"node_id":"MDQ6VXNlcjEwNDAzMA==","avatar_url":"https://avatars1.githubusercontent.com/u/104030?v=4","gravatar_id":"","url":"https://api.github.com/users/rsc","html_url":"https://github.com/rsc","followers_url":"https://api.github.com/users/rsc/followers","following_url":"https://api.github.com/users/rsc/following{/other_user}","gists_url":"https://api.github.com/users/rsc/gists{/gist_id}","starred_url":"https://api.github.com/users/rsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rsc/subscriptions","organizations_url":"https://api.github.com/users/rsc/orgs","repos_url":"https://api.github.com/users/rsc/repos","events_url":"https://api.github.com/users/rsc/events{/privacy}","received_events_url":"https://api.github.com/users/rsc/received_events","type":"User","site_admin":false},"assignees":[{"login":"rsc","id":104030,"node_id":"MDQ6VXNlcjEwNDAzMA==","avatar_url":"https://avatars1.githubusercontent.com/u/104030?v=4","gravatar_id":"","url":"https://api.github.com/users/rsc","html_url":"https://github.com/rsc","followers_url":"https://api.github.com/users/rsc/followers","following_url":"https://api.github.com/users/rsc/following{/other_user}","gists_url":"https://api.github.com/users/rsc/gists{/gist_id}","starred_url":"https://api.github.com/users/rsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rsc/subscriptions","organizations_url":"https://api.github.com/users/rsc/orgs","repos_url":"https://api.github.com/users/rsc/repos","events_url":"https://api.github.com/users/rsc/events{/privacy}","received_events_url":"https://api.github.com/users/rsc/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/71","html_url":"https://github.com/golang/go/milestone/71","labels_url":"https://api.github.com/repos/golang/go/milestones/71/labels","id":3130892,"node_id":"MDk6TWlsZXN0b25lMzEzMDg5Mg==","number":71,"title":"vgo","description":null,"creator":{"login":"rsc","id":104030,"node_id":"MDQ6VXNlcjEwNDAzMA==","avatar_url":"https://avatars1.githubusercontent.com/u/104030?v=4","gravatar_id":"","url":"https://api.github.com/users/rsc","html_url":"https://github.com/rsc","followers_url":"https://api.github.com/users/rsc/followers","following_url":"https://api.github.com/users/rsc/following{/other_user}","gists_url":"https://api.github.com/users/rsc/gists{/gist_id}","starred_url":"https://api.github.com/users/rsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rsc/subscriptions","organizations_url":"https://api.github.com/users/rsc/orgs","repos_url":"https://api.github.com/users/rsc/repos","events_url":"https://api.github.com/users/rsc/events{/privacy}","received_events_url":"https://api.github.com/users/rsc/received_events","type":"User","site_admin":false},"open_issues":64,"closed_issues":197,"state":"open","created_at":"2018-02-20T19:51:55Z","updated_at":"2018-06-29T22:32:05Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2018-05-23T18:39:16Z","updated_at":"2018-06-30T10:28:17Z","closed_at":"2018-06-29T04:23:39Z","author_association":"MEMBER","body":"go.modverify guarantees that only the main source repository needs to be securely obtained and verified for the whole build to be verified and reproducible. It also enables untrusted proxies.\r\n\r\nGo has a culture of secure by default, so we should provide this safety automatically. Also, most people will be upgrading from dep, so we should not downgrade their security in the process.\r\n\r\nA flag to disable modverify is probably not needed, if someone wants to turn off the brakes they can easily add the file to gitignore and/or script its removal.\r\n\r\n@rsc suggested renaming it to `go.sum`, which sounds good to me.\r\n\r\nThis is not to say that we don't aim to build a better verification system that will hopefully replace go.sum files for most users, but that will take more time than vgo adoption will hopefully take."},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/401532400","html_url":"https://github.com/golang/go/issues/25525#issuecomment-401532400","issue_url":"https://api.github.com/repos/golang/go/issues/25525","id":401532400,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTUzMjQwMA==","user":{"login":"CJ-Jackson","id":638378,"node_id":"MDQ6VXNlcjYzODM3OA==","avatar_url":"https://avatars0.githubusercontent.com/u/638378?v=4","gravatar_id":"","url":"https://api.github.com/users/CJ-Jackson","html_url":"https://github.com/CJ-Jackson","followers_url":"https://api.github.com/users/CJ-Jackson/followers","following_url":"https://api.github.com/users/CJ-Jackson/following{/other_user}","gists_url":"https://api.github.com/users/CJ-Jackson/gists{/gist_id}","starred_url":"https://api.github.com/users/CJ-Jackson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CJ-Jackson/subscriptions","organizations_url":"https://api.github.com/users/CJ-Jackson/orgs","repos_url":"https://api.github.com/users/CJ-Jackson/repos","events_url":"https://api.github.com/users/CJ-Jackson/events{/privacy}","received_events_url":"https://api.github.com/users/CJ-Jackson/received_events","type":"User","site_admin":false},"created_at":"2018-06-30T10:28:17Z","updated_at":"2018-06-30T10:28:17Z","author_association":"NONE","body":"@myitcv Yes I am\r\n\r\nWindows\r\n```\r\n$ git rev-parse --short HEAD\r\nbbcfaa0\r\n```\r\n\r\nLinux\r\n```\r\n$ git rev-parse --short HEAD\r\nbbcfaa0\r\n```\r\n\r\nI just notice a new commit in vgo, I'm going to update vgo and do the shasum again."}}
{"actor":{"display_login":"CJ-Jackson"}}