From a048cf7a6d3c0ecce0f316020a7704619224c96f Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Mon, 21 Sep 2026 20:32:48 +0000 Subject: [PATCH] makefile: fetch tailscale.com via the module proxy in update-oss The update-oss target set GOPROXY=direct for the whole go get because proxy.golang.org caches branch resolution and often returned a stale commit for tailscale.com@main. But direct mode also made every dependency a slow git clone. Instead, resolve the tip of main ourselves with git ls-remote and go get that exact commit. The proxy fetches explicit revisions on demand, so tailscale.com and all of its dependencies come from the proxy. If that fails, fall back to GONOPROXY=tailscale.com so only tailscale.com is fetched directly while everything else still uses the proxy. This is motivated by a wireguard-go tag that changed after sum.golang.org grabbed it, so: go: upgraded golang.zx2c4.com/wireguard/windows v0.5.3 => v1.0.1: error finding sum for golang.zx2c4.com/wireguard/windows@v1.0.1: golang.zx2c4.com/wireguard/windows@v1.0.1: verifying module: checksum mismatch downloaded: h1:zRLGRx84kiOcxqkYLoeKYCQNBO2tKYOKXu7AvlSZ6h4= sum.golang.org: h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8= Instead, get it from proxy.golang.org which doesn't match the upstream git tag anymore, but passes the sum.golang.org validation. Fixes tailscale/corp#48607 Signed-off-by: Brad Fitzpatrick Change-Id: I7c2e4f9a1b3d5e6f8a0b2c4d6e8f0a1b3c5d7e9f --- Makefile | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 6d830804af..8e9b429253 100644 --- a/Makefile +++ b/Makefile @@ -315,7 +315,18 @@ bump-version-code: tailscale.version update-oss: curl -f https://raw.githubusercontent.com/tailscale/tailscale/refs/heads/main/go.toolchain.rev > go.toolchain.rev.new mv go.toolchain.rev.new go.toolchain.rev - GOPROXY=direct ./tool/go get tailscale.com@main +# Resolve main to a commit ourselves rather than asking the Go module +# proxy for tailscale.com@main, because the proxy caches branch +# resolution and often returns a stale commit. With an explicit commit +# the proxy fetches it on demand, so both tailscale.com and all of its +# dependencies come from the proxy rather than slow direct git clones. +# If the proxy fails for some reason, fall back to fetching just +# tailscale.com directly while still using the proxy for everything else. + REV=$$(git ls-remote https://github.com/tailscale/tailscale.git refs/heads/main | cut -f1) && \ + test -n "$$REV" && \ + echo "Updating tailscale.com to $$REV" && \ + (./tool/go get tailscale.com@$$REV || \ + GONOPROXY=tailscale.com ./tool/go get tailscale.com@$$REV) ./tool/go mod tidy -compat=1.24 # Get the commandline tools package, this provides (among other things) the sdkmanager binary.