r/golang

5d ago

u/No-Strength-2889

Go (Golang) Publisher Attestation and Signature Verification

help

What is the recommended approach for verifying publisher attestations and signatures for Go (Golang) packages?

comcastbusiness

•

Ad

Get the most comprehensive cybersecurity for small business at the best price + ask about a $500 prepaid card.

Learn More comcastbusiness.com

Best

Open comment sort options

Comments Section

Flimsy_Complaint490

5d ago

what's the use case ? Validating SBOM's ? Sigstore is the standard and cosign is the standard tool at this point.

Development ? Go modules has their validation. Doesnt really stay anything about identity, but it does validate the package is from the same place and not spoofed.

No-Strength-2889

5d ago

Use case is checking whether our pinned Go dependencies have verifiable publisher provenance.…