Usually your build keeps working, because the default module proxy caches module versions and most builds fetch through it. But a cache is not a promise. Only a vendor directory or a proxy you run guarantees you can build when an upstream repository disappears.
What Go does by default
The Go team's supply chain article describes the Go module mirror as a proxy that caches module versions. Authors do not register an account or upload versions to it. The default GOPROXY is https://proxy.golang.org,direct, so the go command asks the mirror first and falls back to version control. A comma means the next entry is tried only on a 404 or 410 response.
The checksum database is separate. It is a global append only list of go.sum entries, so everyone who gets a given version should get the same contents.
What can go wrong
- A version you never fetched before is not in your caches, and may not be in the mirror.
- Private modules skip the public mirror by design, so their availability is your own hosting.
- Corporate caches expire, and CI runners often start empty.
- If a module is gone and
GOPRIVATEor direct fetches are involved, builds fail at download time.
Options compared
| Option | Build survives repo deletion? | Cost |
|---|---|---|
| Public mirror only | Often, not guaranteed | None |
| Persistent module cache in CI | For versions already cached | Cache management |
| Internal proxy that stores versions | Yes, for versions it has fetched | Run and secure a service |
| go mod vendor | Yes, builds from the repo itself | Larger repo, review of vendored diffs |
The Go reference says -mod=vendor uses the vendor directory and does not use the network or the module cache. See when to vendor.
Steps to prepare
- List your critical dependencies and note which are private.
- Decide the guarantee you need. Most teams can accept the public mirror for open source and require control only for production release builds.
- If you need control, stand up an internal proxy and point
GOPROXYat it, or vendor. - Rehearse: run a clean build with
GOPROXY=offand see what fails. That setting means no communication is attempted, per the Go reference. - Keep go.sum committed, so any replacement copy is checked against the original hash.
What deletion does not mean
A deleted repository could also reappear under another owner. Your go.sum hashes protect you there: new contents under the same version fail verification. That is one reason not to remove or regenerate go.sum casually.
Where Safeguard fits
Safeguard's SBOM and dependency scanning record exactly which module versions your builds used, which helps when you need to rebuild or investigate. Try a free scan.
Quick check
Does the Go mirror guarantee availability?
No. It caches versions, but the Go documentation does not promise permanent availability.
What does GOPROXY=off do?
It tells the go command to attempt no communication, which makes it a good test of offline builds.
Sources
Last reviewed: 19 October 2026.
