Eighty-one megabytes of hello world
How big is a tool that does nothing? For go-tool-base it was 81 MB, and a comment in the code said it shouldn't have been.
Tags
5 pages
Dependencies
My reason for hand-rolling it was wrong
I wrote my own OpenPGP packet code, then deleted the lot to prove I needed it. The reason I'd given turned out to be nonsense, and there was a better one waiting for me.
Merged in five days, open in seven hundred
Leaving a healthy dependency: cockroachdb/errors predates Go 1.20, so its Join hides the aggregate and everything below it goes missing.
Nobody's coming to clean your supply chain
Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
