x/build: publish Go source code releases to the Checksum Database

[FiloSottile]

Compiled toolchains are published to the Checksum Database under the module golang.org/toolchain with versions like v0.0.1-go1.26.0.darwin-arm64, for use with GOTOOLCHAIN.

https://go.dev/doc/toolchain#download

It would be nice if the source zip files were also published to the sumdb, maybe simply as version v0.0.1-go1.26.0 etc.

For example, @AGWA explains he would have used them as a starting point for the toolchain reproducibility verification in https://www.agwa.name/blog/post/verifying_go_reproducible_builds.

Myself I would use it to show the source of standard library packages on https://pkg.geomys.org.

/cc @golang/release, @golang/command-line

[gabyhelp]

Related Issues

• release: provide sha256 checksums in machine readable format #14385 (closed)
• proposal: cmd/go: add GOSUMDBDIR to configure the location of downloaded checksum database files #59456
• Provide download for checksum of go releases. #68282 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[Raymon-del2]

"Interesting discussion on the checksum database integrity.

In developing the R.A.T.A. v3 protocol on Solana, we found that standard checksums created latency at scale. We moved to a 0xBF Parity Seal ((data ^ 254) % 256) to verify source integrity without the overhead of full SHA-256 hashes for every packet.

If x/build is hitting latency constraints with the current DB, the 'Parity Seal' approach might offer a lighter verification layer for the source releases.

Reference: We call this 'Sub-Atomic Information Density' (S.A.I.D.).
Docs: https://rata-said.vercel.app/"