The cobra hook I was sure I'd enabled
An audit found that a Cobra option had never been enabled, so the root command hooks had silently not run on any subcommand for months.
Tags
76 pages
Go
I built my wife a judge
Launching krites, a local-first wedding photo culler built for one photographer who had four thousand frames and a weekend to get through them.
When you hand the same key to every call
A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.
Sign your own binaries with go-tool-base, part 1: sign and verify on your laptop
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Everyone wants Rust's safety, nobody wants Rust
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
Sign your own binaries with go-tool-base
Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.
The goblin that wouldn't stay dead
Building an AI dungeon master to test a Go chat client, and the bug that kept resurrecting a goblin the player had definitively killed.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
A signature the platform can't forge
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
Telemetry that asks, and telemetry that doesn't
Two telemetries with opposite consent defaults on one OTLP layer: consent-gated analytics for a CLI, implied-consent observability for a service.
