Tag
go-sum
Safeguard articles tagged "go-sum" — guides, analysis, and best practices for software supply chain and application security.
2 articles
Supply Chain Security
Do Not Pass GO: Malicious Golang Package Alert
A typosquat of boltdb/bolt stayed cached on Go's module proxy for roughly three years after its source repo was cleaned up — proxy caching beats takedowns.
Jul 16, 20266 min read
Open Source Security
Go Checksum Verification Patterns
go.sum and the Go checksum database are among the most rigorous integrity mechanisms in any language ecosystem, and the verification patterns around them deserve to be understood and used well.
Jul 5, 20247 min read