[jhheider]

proxy.golang.org intermittently drops module zips mid-download (stream error: stream ID N; INTERNAL_ERROR; received from peer). It failed eight pantry builds in two days (coder ×3, odigos, openbao, wails ×2, gitlab-runner), each fixed by a plain rerun.

build.ts and test.ts run their scripts with clearEnv: true, so a GOPROXY set in the pantry workflow never reaches go. This sets a default in brewkit instead:

• GOPROXY=https://proxy.golang.org|direct. The | separator falls back to fetching from the module's source on any proxy error; , only falls back on 404/410, so it wouldn't help here.
• GOPROXY joins the pass-through list, so a caller's value overrides the default.
• Direct fetches are still verified against go.sum and sum.golang.org.

Validation

bk on charm.sh/gum, with a clean module cache each time:

caller env	result
GOPROXY=http://127.0.0.1:1	build fails: override reaches go
GOPROXY='http://127.0.0.1:1|direct'	builds: fallback works
unset	builds, bk test and bk audit pass

Before this change, the dead-proxy case built fine because the variable was dropped.

deno test --allow-env --allow-net --ignore=.data has the same 5 local failures with and without this change.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Tests may lack Git for fallback, GOPROXY credentials can leak to logs, Docker drops the override, and omitted Go privacy settings can expose private module paths.

4 open issues

• Redact GOPROXY credentials from environment dumps · New
• Preserve Go privacy settings with GOPROXY · New
• Forward GOPROXY through the Docker boundary · New
• Make Git available to tests during proxy fallback · New

What changed in this PR

This PR updates brewkit’s build and test environments to recover from Go module proxy errors by falling back to direct source downloads.

Changes:

• Default GOPROXY to https://proxy.golang.org|direct, allowing fallback on any proxy error.
• Pass through caller-supplied GOPROXY values to override the default.

File	Description
test/​test.ts	Adds the proxy default and caller override to the sanitized test environment.
build/​build.ts	Adds the same build configuration and documents the fallback separator.

_{Review effort: Balanced}