Go's checksum database makes dependency versions publicly consistent
engineeringgomodulessecuritydependenciesThe public module mirror caches dependency inputs, while the checksum database checks their contents against an auditable log. The separation lets availability improve without making the mirror the authority on code identity.