Resurrecting gosumdb: Independently Auditing the Go Module Supply Chain

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

When you run go get , you’re implicitly trusting Google’s sum.golang.org checksum database (gosumdb) to serve the correct cryptographic hash for your dependencies. This system is a massive leap forward for supply chain security, but only if we can independently verify its trustworthiness. That’s why I built gosumdb (the project, not the service): an independent, third-party…

Read on localhost ↗