I'm worried people will forget this is turned off and not realize we're exposing ourselves

[n3wscott]

I'm worried people will forget this is turned off and not realize we're exposing ourselves

Can we add retries for CI?

Originally posted by @dprotaso in #10 (comment)

[dprotaso]

Further discussion:
https://knative.slack.com/archives/CCSNR4FCH/p1604425778429100

[krsna-m]

Slack context is lost please reopen with context whenever

[dprotaso]

Context:

When we fetch dependencies we were getting 4xx errors because they didn't show up in the module mirror and checksum database (there's a bit of a delay). To avoid this we turned off using the mirror and the checksum db. Doing this opens us up to a potential supply chain attack - since we aren't verifying the sums.

Settings are here: https://go.dev/ref/mod#checksum-database

[dprotaso]

I think the env var settings let you tweak which modules we do verification on - that could be an minimal option here.