fix: GOPROXY and dependency issues

[tpounds]

Updates Makefile to use official GOPROXY (proxy.golang.org) to detects issues in which third party module proxies differ in checksum behavior for broken/invalid packages. In this case the proxy.golang.org less permissive than gocenter.io.

The issue can easily be reproduced with the following commands:

Works:

$ go clean -modcache
$ GOPROXY=gocenter.io go get code.gitea.io/gitea@v1.10.0-dev.0.20190711052757-a0820e09fbf7

Broken:

$ go clean -modcache
$ GOPROXY=proxy.golang.org go get code.gitea.io/gitea@v1.10.0-dev.0.20190711052757-a0820e09fbf7

[tpounds]

Mirrors a similar pr made to godownloader.

see: goreleaser/godownloader#135

[tpounds]

@caarlos0 This partially reverts the removal of the go-macaron/cors replace directive made in #1152. Unfortunately, this wasn't caught due to differences in the way proxy.golang.org and gocenter.io due version validation.

[codecov-io]

Codecov Report

Merging #1155 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1155   +/-   ##
=======================================
  Coverage   82.71%   82.71%           
=======================================
  Files          58       58           
  Lines        3257     3257           
=======================================
  Hits         2694     2694           
  Misses        481      481           
  Partials       82       82

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eb1a122...d627974. Read the comment docs.

[caarlos0]

thanks :)

[ankushchadha]

@tpounds GoCenter does validation before a go module version is served to the users. As part of the validation, a go get operation is executed. For module versions where a go get failed, those are not served by GoCenter and the status is reflected in the UI.

When this module was included in GoCenter, there was no Go 1.13 and a go get operation works with Go 1.12 for github.com/go-macaron/cors v0.0.0-20190309005821-6fd6a9bfe14e9.

Since we honor immutability and availability requirement, GoCenter will continue to serve this module version. There might be bugs in Go 1.12 but atleast that was the actual behavior in Go 1.12 which is what we honor.

[tpounds]

@ankushchadha Thanks for the info! I didn't investigate too deeply but figured it had to do with slight differences between how Go 1.12 and 1.13 handled modules. Unfortunately, this change is somewhat necessary since lots of folks will be transparently migrating to the default proxy when they upgrade to Go 1.13.

[kamilsk]

default is

$ go env GOPROXY
https://proxy.golang.org,direct

and sometimes https://proxy.golang.org is unavailable

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.