Go Proxy Security, Part 1: A critical piece of infrastructure

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

When pulling dependencies for Go via go mod, the dataflows are not obvious for the user. You import a github.com/… and the rest happens automatically. In the default settings, go pulls these dependencies from proxy.golang.org, not from github.com. This solves one issue in Software Supply Chains: Vanishing dependencies. When the npm package left-pad was removed from npm, this led to failing builds…

Read on localhost ↗