<![CDATA[Growing convinced we could and should ship new version cooldown in the Go modules ecosystem.]]>Growing convinced we could and should ship new version cooldown in the Go modules ecosystem.

The subdb and MVP get us far, and supply chain attacks are not much of a thing in Go beyond typosquatting, but we want to stay ahead of them.

Link Preview Image
proposal: cmd/go: support dependency cooldown in Go tooling · Issue #76485 · golang/go

Proposal Details Background Supply chain attacks on open-source software dependencies have become a regular occurrence. Go already takes measures against supply chain attacks. While Go libraries aren't a common target, this year GitLab d...

favicon

GitHub (github.com)

]]>https://board.circlewithadot.net/topic/288b1b51-e449-4f1e-8c30-23a2f98c9618/growing-convinced-we-could-and-should-ship-new-version-cooldown-in-the-go-modules-ecosystem.RSS for NodeFri, 10 Apr 2026 16:05:21 GMTThu, 12 Mar 2026 02:11:22 GMT60<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 15:46:41 GMT]]>@filippo If you force an upstream fetch you get a big fatal error about the checksums not matching (which will detect the substitution). Otherwise you'll pull without any way to discover that the upstream and the proxy don't match.

(I force pulls of upstream for my own eccentric reasons so I get to see this every so often.)

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116222643513587643https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116222643513587643Fri, 13 Mar 2026 15:46:41 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 08:49:29 GMT]]>@cks yep see https://words.filippo.io/go-source/

There is no “unless you force an upstream fetch” though: unless you turn off the sumdb there is only one true version. The issue is using an unverifiable view like the GitHub UI to try to view it.

Not different from any other ecosystem though: plenty of malicious npm packages with innocent code on GitHub.

]]>https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116221003027924788https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116221003027924788Fri, 13 Mar 2026 08:49:29 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 02:39:11 GMT]]>@filippo This has made me think of a little attack that's basically a reverse tag replacement attack:
* get access to a repo and publish a compromised version with a new version tag
* get the Go proxy to fetch and cache your new version
* force-push an innocent version under the same tag

People will look at your repo and see harmless code under the tag, but I believe actual 'go mod' updates use the proxy's cached version (compromised) and its cached sum, unless you force upstream use?

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116219546952428370https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116219546952428370Fri, 13 Mar 2026 02:39:11 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 00:52:21 GMT]]>@filippo seeing Google finally publishing rust ones gives me hope. We need to keep breaking the seal, not let people freak out, and just get on with it

]]>https://board.circlewithadot.net/post/https://don.rag.pub/users/raggi/statuses/116219126824588740https://board.circlewithadot.net/post/https://don.rag.pub/users/raggi/statuses/116219126824588740Fri, 13 Mar 2026 00:52:21 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 00:41:20 GMT]]>@filippo Sorry, I didn't manage to say my actual thought. I think the dependabot race shows that today, people are updating rapidly as soon as new versions become visible to them, even with MVP. So slowing down visibility through a cooldown would buy time.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116219083551434462https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116219083551434462Fri, 13 Mar 2026 00:41:20 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 00:36:10 GMT]]>@raggi Review attestation is one of those things I heard talked about for all of my career and never once saw implemented successfully at scale. Even at large companies with employees!

There's a fundamental incentives problem which I mostly saw ignored or anyway unsolved.

]]>https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219063187131377https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219063187131377Fri, 13 Mar 2026 00:36:10 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 00:34:48 GMT]]>@markd Why wouldn't clients that are most sensitive to risk adopt a longer, instead of shorter, cooldown?

]]>https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219057858728565https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219057858728565Fri, 13 Mar 2026 00:34:48 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Fri, 13 Mar 2026 00:34:20 GMT]]>@cks Editing a tag is indistinguishable from an attack, so it will never work, cooldown or not. The cooldown clock starts when the sumdb captures the first contents, which then are it forever.

]]>https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219056020002587https://board.circlewithadot.net/post/https://abyssdomain.expert/users/filippo/statuses/116219056020002587Fri, 13 Mar 2026 00:34:20 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Thu, 12 Mar 2026 11:45:39 GMT]]>@filippo we should work on review attestation, given mvs I don’t think this will have a ton of impact

]]>https://board.circlewithadot.net/post/https://don.rag.pub/users/raggi/statuses/116216033416518253https://board.circlewithadot.net/post/https://don.rag.pub/users/raggi/statuses/116216033416518253Thu, 12 Mar 2026 11:45:39 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Thu, 12 Mar 2026 02:54:07 GMT]]>@filippo But then coders will go back to node.js!

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116213943363173018https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116213943363173018Thu, 12 Mar 2026 02:54:07 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Thu, 12 Mar 2026 02:19:37 GMT]]>@filippo If cooldown becomes common would that mean that supply chain attacks would mostly affect early adopters who presumably are more sensitive to the risks?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/markd/statuses/116213807654613688https://board.circlewithadot.net/post/https://hachyderm.io/users/markd/statuses/116213807654613688Thu, 12 Mar 2026 02:19:37 GMT<![CDATA[Reply to Growing convinced we could and should ship new version cooldown in the Go modules ecosystem. on Thu, 12 Mar 2026 02:19:11 GMT]]>@filippo My experience is that I've seen multiple cases where dependabot updates raced with the dependency re-publishing a different thing under the same tag. The result was something that would only build if you used the proxy (which had cached the original published version). This is obviously bad practice (possibly in multiple places), but I think it suggests a cooldown would be useful even with MVP.

(Also maybe dependabot needs a cooldown itself, but ... good luck persuading them.)

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116213806000092659https://board.circlewithadot.net/post/https://mastodon.social/users/cks/statuses/116213806000092659Thu, 12 Mar 2026 02:19:11 GMT