Dependably Packages · Go
A private Go module proxy
One GOPROXY setting for go get and go mod download. Modules come through a pull-through cache, and the checksum database is proxied too, so GOSUMDB stays at its default and the go client verifies every module as usual.
go get · go mod
Point Go at your registry
go env -w persists the setting in Go's own environment file. Mark internal modules with GOPRIVATE on an air-gapped instance.
The placeholders are your base URL and a token from the web UI.
go env -w GOPROXY=https://repo.example.com/go,direct
# the checksum database is proxied too: leave GOSUMDB at its defaultWhat happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The go client checks each module against the checksum database, which Dependably Packages proxies, so a tampered module fails on the client.
- The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
- A name your organization reserves cannot be squatted upstream and resolved into your builds.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The Go guide continues with a verification step and reverting the configuration. Go is served as a mirror: it proxies and caches, and does not accept uploads.