Sign your own binaries with go-tool-base, part 5: embed the key and require verification
Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.
Tags
6 pages
Self-Update
A signature the platform can't forge
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
Building a CLI with go-tool-base, part 5: a CLI that updates itself
Add self-update to a Go CLI: resolve releases per platform, compare versions, verify checksums and migrate config on upgrade.
A signing key needs somewhere to live
A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.
Process isolation won't save you from the filesystem
A flaky self-update test: separate processes still shared a computed cache path and raced on disk. Process isolation is not filesystem isolation.
Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
