Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
Tags
39 pages
Security
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
Where should a CLI keep your API keys?
Credential storage for a Go CLI: an env-var reference by default, an opt-in OS keychain, and plaintext only as a last resort and banned in CI.
A configurable AI endpoint is an attack surface
A user-settable AI base URL decides where your API key gets sent. Validating it to reject userinfo, non-HTTPS schemes and redirects.
Redacting the secret you didn't know was in the string
Catching secrets by shape rather than by name: patterns for provider key prefixes, URL userinfo and auth headers, plus a fuzzy fallback.
I had the framework audited: every finding was the same shape
Every finding in a security audit reduced to untrusted input reaching a powerful operation unchecked. One checked chokepoint per boundary fixes it.
OpenSSF Scorecard graded my supply chain
Running OpenSSF Scorecard on a Go project flagged mutable action tags, over-broad workflow token permissions, and a missing maintenance signal.
AI conversations you can resume
Persisting an AI conversation in Go: snapshot the messages, prompt and tool metadata, and deliberately never the handlers or the API token.
Encrypting additional drives with LUKS on Linux
Encrypting an additional drive on Linux with LUKS: partition it, generate a keyfile, encrypt it and mount it automatically at boot.
