Replacing google.golang.org/protobuf with github.com/protocolbuffers/protobuf-go

[nalzok]

Hi there,

I am trying to package this repository to MacPorts (a package manager for macOS). Apparently, the tarballs from the domain google.golang.org/protobuf are not deterministic, so MacPorts doesn't support specifying dependencies with it. Can you replace google.golang.org/protobuf v1.23.0 with github.com/protocolbuffers/protobuf-go v1.23.0?

It would be extra awesome if you could cut a release after that, so that I have a release tag to pin.

... and Merry Christmas! 🎄

[cmikk]

If I'm reading the MacPorts discussion correctly, it appears that this substitution occurs in the MacPorts Portfile, where the go import path google.golang.org/protobuf is fetched from the manually-specified path github.com/protocolbuffers/protobuf-go rather than the import path's default -- see lines 602-607 in the Portfile attached to the next MacPorts discussion comment.

Note that the GitHub path's contents include a go.mod file declaring the module with the google.golang.org/protobuf import path. This effectively prevents go get from fetching and recording dependencies on the GitHub path, which is why I suspect the deterministic download magic is happening within the MacPorts system.