Introducing Go Support

Today is an exciting day for all Go developers! We're thrilled to unveil Socket's early access support for the Go programming language.

Since we started Socket, our mission has been to fortify the software supply chain against attacks. We began our journey safeguarding JavaScript applications against the dangers of the NPM ecosystem. Over the last few months, we've been hard at work detecting and defending against threats unique to Python. Now, we're taking a significant leap by extending our support to Go, or as many of you fondly call it, Golang!

Why Go?#

Go's lightning speed, concurrency support, and simple syntax have made it an ideal choice for various applications – from web servers to networking tools and data pipelines. Given Go's increasing popularity as a general purpose language, it's only natural that the ecosystem surrounding Go would grow. However, as with all burgeoning ecosystems, it has become a target for potential supply chain threats.

After being introduced in 2018, Go Modules clarified Go's dependency management situation, bringing reproducibility and verifiability to the Go ecosystem. But Go Modules are not immune to threats. Over the past few months, we've observed an uptick in supply chain attacks targeting Golang. Recognizing this imminent threat, we knew it was time to bring Socket's proven proactive protection to Go.

Go-specific Challenges#

Adding support for Go wasn't without its challenges:

1. Custom Dependency Management: Unlike npm or pip, which have centralized repositories, Go's decentralized approach with its VCS-based dependency fetching can be much trickier to monitor. Tools that use the GOPROXY protocol as a crutch will miss the newest versions published to version control systems, which are the very packages most likely to begin a supply chain attack.
2. No lockfile: The go.sum file isn't a lockfile, but rather Go's last line of defense against hijacked version tags in VCS repositories and module proxies. While it's an important part of keeping Go's ecosystem secure, it alone cannot protect against dangerous code within a Go module.
3. Dynamic Versioning: Go Modules' pseudo-versions provide untagged commit-based versioning, adding another layer of complexity to tracking dependencies.
4. Transitive Dependencies: Monitoring indirect dependencies requires a deep understanding of the go.mod file and Minimal Version Selection. A security tool needs to understand potential vulnerabilities in Go's module resolution scheme and the dangers that can be introduced via transitive dependencies. As we've seen in the npm ecosystem, when security tools fail to properly parse the dependencies in use, chaos and security flaws often follow.

Our team has been hard at work understanding the intricacies of Go and ensuring that Socket can offer the same robust protection for Go projects that it does for JavaScript and Python.

Early Access for Go Support#

As we roll out broader support for Go, we're currently offering an "early access" phase with beta features and functionality for all customers. This phase will allow us to fine-tune our Go offering, ensuring that when we launch Go support with all of Socket's core analysis techniques in the near future, our integration is the best it can be.

Key Features:#

• Full analysis of go.mod files with verification against go.sum checksums
• Support for detecting known vulnerabilities across the entire dependency build list of any given project or package
• Monitoring of both direct and indirect dependencies
• Compatibility checks for module replacements and exclusions
• Package explorer and search on the Socket website
• Go issues listed in Socket reports

Socket's Go Roadmap#

We're doubling down on our efforts to strengthen our Go capabilities. In the coming weeks, expect:

• Integration into Socket for GitHub and Socket for VSCode
• Enhanced Go Modules support
• Improved AI-powered Go issue detection and zero-day vulnerability monitoring
• A comprehensive guide on securing your Go applications with Socket

Try our Early Access#

If Go forms the backbone of your software projects and you're eager to enhance their security, try out our package search and issue pages on the Socket website or upload a report with your go.mod files through our CLI.

We remain committed to our mission: making open-source software secure for every developer, regardless of the language they code in. Our journey with Go has just started, and we're eager to have you be part of it.

Questions, feedback, or just want a chat? Schedule a demo with our technical experts. Let's make Golang development safer together!

Happy Go coding! 🚀