Supply Chain Security with Go

Security Devops

Learn essential Go security practices: module verification, vulnerability scanning, sandboxing techniques, secure deployments, and hardening Go apps against supply chain attacks.

Key takeaways

Go modules provide built-in supply chain security through cryptographic verification and immutable versions
The Go checksum database ensures module authenticity by storing cryptographic hashes centrally
go-vulncheck performs static analysis to detect vulnerable dependencies and affected code paths
Best practices for securing Go applications:
- Run services under dedicated user accounts, not as root
- Use system call filtering with seccomp
- Enable systemd sandboxing
- Split untrusted dependencies into separate processes
The Go toolchain is reproducible since Go 1.21, allowing verification of binaries
Use GOPROXY and private proxies to control module access and improve organizational privacy
GoCrazy provides a minimal Go-based appliance platform with reduced attack surface
- No C userland or runtime environment
- No OpenSSL, OpenSSH or other common vulnerability sources
- Uses Wi-Fi and Tailscale for secure remote access
Keep toolchains updated using go version -m to check and GOTOOLCHAIN to manage versions
Pre-announcements for security fixes are made 3-7 days before releases
Subscribe to golang-announce mailing list for security notifications

Supply Chain Security with Go

More talks