embed-generator: every dependency it pins is still served, and matched the hash it committed
All 2836 dependency hashes pinned in its 2 go.sum files were still served on 2026-09-13, and every one matched the hash the project committed.
About embed-generator
We fetched each pinned version from https://proxy.golang.org/<module>/@v/<version>.mod (or .zip for the lines that pin a source archive) and recomputed Go's h1 dirhash over the bytes served, comparing each with the hash in the project's own go.sum. It took 101 seconds. All 2836 pinned hashes matched.
Its 2 pin files (go.work.sum, embedg-server/go.sum) pin 2836 hashes across 2101 module versions, of which 740 name a module's source archive and 2096 name only its go.mod.
We fetched 583.4 MB from proxy.golang.org to do it.
We cloned the repository at commit 8d6460509a94 from its go.work.sum, embedg-server/go.sum and read it under sandbox-exec -- (deny default) after importing the base BSD profile, reads allowed only under the system and toolchain paths and the scratch directory, writes confined to that scratch directory, the environment replaced with env -i. The user's home directory is on no allow list. Python 3.14.6 and no Go toolchain -- this is a hash comparison, not a build. We did not build the project and we did not install a Go toolchain: no module archive was extracted to a path and nothing from any of them was executed. This says whether the pinned dependencies are still fetchable and unchanged on that day, and nothing about whether the project compiles.