Sign your own binaries with go-tool-base, part 1: sign and verify on your laptop
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Tags
73 pages
Go
Everyone wants Rust's safety, nobody wants Rust
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
Sign your own binaries with go-tool-base
Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.
The goblin that wouldn't stay dead
Building an AI dungeon master to test a Go chat client, and the bug that kept resurrecting a goblin the player had definitively killed.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
A signature the platform can't forge
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
Telemetry that asks, and telemetry that doesn't
Two telemetries with opposite consent defaults on one OTLP layer: consent-gated analytics for a CLI, implied-consent observability for a service.
Building a web service with go-tool-base, part 6: seeing what your service is doing
Add OpenTelemetry traces, metrics and logs to a Go service with middleware and manual spans, and get one end-to-end trace through the gateway.
Building a web service with go-tool-base, part 5: docs that write themselves
Generate an OpenAPI v3 document from an annotated proto file and serve it from the same HTTPS server with an embedded Stoplight Elements UI.
Building a web service with go-tool-base, part 4: REST for free, with the gateway
Replace a hand-written REST layer with grpc-gateway: add google.api.http annotations, generate the gateway, and delete the duplicate encoding.
