Security of Go Modules and Vulnerability Scanning in GoCenter
summary
Go modules use a go.sum file of SHA‑256 base64 checksums that are recorded in Google’s official checksum database gosumdb and validated by GOPROXY to prove a version wasn’t tampered with. The database uses a Merkle tree so altering a record changes the root and breaks verification. That guarantees integrity but not correctness — a first release with a vulnerability stays vulnerable — so GoCenter mirrors modules, scans versions for known CVEs and flags which releases are safe to use.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:21DEPENDENCY MANAGEMENT IN GOLANG
- 1:34GO.SUM FILE
- 2:22SECURE HASH ALGORITHM (SHA2) AS CHECKSUMS
- 3:30MERKLE TREE BASICS
- 4:48HOW HASHES PROTECT MODULE USERS
- 6:26FREE VULNERABILITY DATA IN GOCENTER.IO
related talks
21mVulnerability Management for Go
38mGo Module Proxy: Life of a Query
31mGo Security – Past, Present, and Future
45mEssential security checks for your Go project
42mGo Module Hygiene: Keeping go.sum and go.mod in check
24mVulnerability Management for Go
25mExploring Some Essential Security Checks for Any Open Source Go Project
22mSecuring Containers Against Known Go Vulnerabilities