How Go Mitigates Supply Chain Attacks

[NewsBot]

A new Go blog post/announcement has been posted!

<div class="Article" data-slug="/blog/supply-chain">

<h1 class="small"><a href="/blog/">The Go Blog</a></h1>


<h1>How Go Mitigates Supply Chain Attacks</h1>
  
  <p class="author">
  Filippo Valsorda<br>
  31 March 2022
  </p>
  
  <p>Modern software engineering is collaborative, and based on reusing Open Source

software.
That exposes targets to supply chain attacks, where software projects are
attacked by compromising their dependencies.

Despite any process or technical measure, every dependency is unavoidably a trust relationship. However, the Go tooling and design help mitigate risk at various stages.

All builds are “locked”

There is no way for changes in the outside world—such as a new version of a dependency being published—to automatically affect a Go build.

Unlike most other package managers files, Go modules don’t...

Get the full details here: How Go Mitigates Supply Chain Attacks - The Go Programming Language