Dependably
Request a demo
Dependably Packages · Go

A private Go module proxy

One GOPROXY setting for go get and go mod download. Modules come through a pull-through cache that verifies every checksum, and the checksum database is proxied too, so GOSUMDB stays at its default.

Read the setup guide About Dependably Packages
go get · go mod

Point Go at your registry

go env -w persists the setting in Go's own environment file. Mark internal modules with GOPRIVATE on an air-gapped instance.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

bash · repo.example.com
go env -w GOPROXY=https://repo.example.com/go,direct
# the checksum database is proxied too: leave GOSUMDB at its default

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

  • The checksum is verified against the digest the upstream publishes before the artefact is stored.
  • The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
  • A name your organization reserves cannot be squatted upstream and resolved into your builds.
  • Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The Go guide continues with a verification step and reverting the configuration. Go is served as a mirror: it proxies and caches, and does not accept uploads.

Read the setup guide Keep bad packages out of your builds.Know which of your projects are exposed, and whether it matters.