gamertan
206d09e4cd
Sanitized snapshot of private source 144ca0a9544042b0477ae732c1356cf0b9d62b3f. Add package selection, adoption workflow, and optional Sandwich Hime integration guidance. AI-Assistance: OpenAI Codex assisted documentation, verification, and publication. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
1.2 KiB
Dependency boundary
Most packages use only the Go standard library. Two direct modules are pinned:
golang.org/x/cryptosupplies the reviewed Argon2id implementation used byauth(BSD-3-Clause upstream licence).modernc.org/sqlitesupplies the no-CGO SQLite adapter inauthsqlite(BSD-3-Clause upstream licence).
Applications that do not import auth or authsqlite do not link those
implementations into their binaries. Optional GeoIP enrichment is an interface
only; the base toolkit performs no lookup and adds no GeoIP dependency.
All packages currently share one Go module, so these requirements remain
visible in the module graph even when an application imports only
requestmeta. Go still avoids compiling or linking unused packages. A future
nested module may isolate a heavyweight adapter such as authsqlite when its
independent dependency and release lifecycle justify the additional tags,
vanity metadata, and CI. See MODULES.md.
go.sum, go mod verify, checksum-database verification, vulnerability
scanning, and the public snapshot allowlist are release gates. Binary
distributors remain responsible for preserving all applicable upstream notices.