Documentation
¶
Overview ¶
Package verify reports Go settings that weaken module verification.
Advisor reads GOSUMDB, GONOSUMDB and GOINSECURE with `go env` and warns when they cover a module. The warnings are advisory: gotools sets none of these itself, and a warning never turns a working install into a failure.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MatchesAny ¶
MatchesAny reports whether any glob in the comma-separated list covers the module path, with the semantics of GOPRIVATE, GONOSUMDB and GOINSECURE (module.MatchPrefixPatterns). Whitespace around an element is trimmed although Go does not: that can only produce more warnings, the safe direction.
Types ¶
type Advisor ¶
Advisor asks the go command what weakens verification.
func (Advisor) Warnings ¶
Warnings lists the settings that weaken verification for modPath, one line each; empty when the default protections are intact. dir is where go runs.
Values come from `go env`, which is authoritative: it reflects the go env file as well as the environment and resolves GONOSUMDB from GOPRIVATE. GOTOOLCHAIN=local keeps the probe from downloading a toolchain. Any trouble reading them yields no warnings.
A pinned go.sum still refuses a tampered module even with GOSUMDB=off, so these flag reduced protection on the first download, not a broken project. There is no GOFLAGS=-insecure check: the go command refuses that flag outright, so the install fails before a warning could matter.
Source Files