CodeVetter · Repo Unpack · Risk map
golang/go
Highest-risk surfaces: (1) supply-chain code execution — toolchain auto-download+re-exec, module fetches, VCS shell-outs, and cgo/gcc/swig invocation; (2) runtime invariants where a single mistake corrupts all programs (scheduler throws, GC write barriers, linkname/unsafe); (3) bootstrap trust — the build requires a pre-existing Go binary; (4) compatibility enforcement — api/ files and GODEBUG semantics are contractual. Many security gates exist (sumdb verification, IsSecure scheme checks, #cgo flag validation) but bypass knobs (GOINSECURE, GONOSUMDB/GONOSUMCHECK, GIT_ALLOW_PROTOCOL, -insecure) weaken them.
- toolchain.Select can download and exec a different toolchain binary on every invocation; the internal switch protocol (targetEnv/countEnv) is filtered from user env via FilterEnv, but a compromised proxy/toolchain module would execute arbitrary code — mitigated by sumdb verification and maxSwitch loop detection.
- modfetch unzips remotely fetched archives into the module cache; integrity depends on checkMod comparing against go.sum and sum.golang.org (dirhash); Fetcher.Unzip bypass path exists for shipped GOFIPS140 zips.
- vcs.go executes git/hg/svn/fossil binaries against module-controlled repo URLs; scheme security is enforced via isSecureScheme (https/ssh only) and honors GIT_ALLOW_PROTOCOL, but repo-root discovery parses remote HTML/meta tags via cmd/go/internal/web.
- cgo compiles package-supplied C/C++/Fortran and runs pkg-config and swig; buildFlags validates #cgo flags (security against flag injection), DefaultCFlags='-O2 -g'; malicious module C sources execute at build time.
- The scheduler has many hard invariants enforced by throw() — 'schedule: holding locks', 'schedule: in cgo', 'runtime.main not on m0', 'nanotime returning zero' — a violation crashes the whole program; the spinning-thread protocol comment documents known underutilization race windows.
- GC correctness depends on write-barrier discipline; the compiler's nowritebarrierrec check (ssagen.EnableNoWriteBarrierRecCheck/NoWriteBarrierRecCheck) runs only when compiling the runtime — a fragile coupling between compiler flags and runtime safety.
- Bootstrap requires trusting a prebuilt Go >= 1.26.0 (GOROOT_BOOTSTRAP); make.bash refuses GOROOT_BOOTSTRAP==GOROOT but cannot verify provenance — classic trusting-trust exposure; GOEXPERIMENT is deliberately forced to 'none' for toolchain1 to avoid skew.
- make.bash contains environment probes that can block or corrupt builds: gold 2.20 ld detection, SELinux allow_execstack check, src/pkg staleness fatal in cmdbootstrap — build failures here are environment-specific and hard to reproduce.
- //go:linkname and unsafe let user code bypass type safety into runtime internals; linker flag -checklinkname (default true) exists specifically to police linkname references, indicating a known abuse vector; test/linkname.dir exercises it.
- Telemetry writes counter files and spawns upload sidecars (MaybeChild/MaybeParent) — privacy-sensitive surface; special-cased so 'go telemetry off' works without opening counter files, and cmdIsGoTelemetryOff scans os.Args pre-parse.
- Removed GODEBUG settings produce a fatal() at program startup — a deliberate compat break that can kill binaries built with older defaults if the env carries stale settings.
- api/ files are a contractual freeze: adding to a released go1.N.txt is forbidden (files 'add new lines but do not remove any'), and post-1.19 entries must cite a proposal issue — editing the wrong file silently breaks the compatibility checker.
- Two parallel type checkers exist (go/types in std and cmd/compile/internal/types2 for the compiler) that must be kept in sync; skew between them is a recurring correctness risk. (inferred)
- Generated files must stay in sync with generators: flagdefs.go (from genflags.go), opGen.go/rewrite rules in ssacompile, and files produced by writeGeneratedFiles in dist; editing outputs without regenerating causes subtle drift. (inferred)