# Risk map — golang/go

> Canonical page: https://codevetter.com/unpack/go/risk-map

# Risk map — golang/go

Scanned commit 12c76d447f576e6c14c566c8524c13a0c0d476b9 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Highest-risk surfaces: (1) supply-chain code execution — toolchain auto-download+re-exec, module fetches, VCS shell-outs, and cgo/gcc/swig invocation; (2) runtime invariants where a single mistake corrupts all programs (scheduler throws, GC write barriers, linkname/unsafe); (3) bootstrap trust — the build requires a pre-existing Go binary; (4) compatibility enforcement — api/ files and GODEBUG semantics are contractual. Many security gates exist (sumdb verification, IsSecure scheme checks, #cgo flag validation) but bypass knobs (GOINSECURE, GONOSUMDB/GONOSUMCHECK, GIT_ALLOW_PROTOCOL, -insecure) weaken them.
- toolchain.Select can download and exec a different toolchain binary on every invocation; the internal switch protocol (targetEnv/countEnv) is filtered from user env via FilterEnv, but a compromised proxy/toolchain module would execute arbitrary code — mitigated by sumdb verification and maxSwitch loop detection. — [src/cmd/go/internal/toolchain/select.go#L37-119](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/toolchain/select.go#L37-L119) [go.env](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/go.env)
- modfetch unzips remotely fetched archives into the module cache; integrity depends on checkMod comparing against go.sum and sum.golang.org (dirhash); Fetcher.Unzip bypass path exists for shipped GOFIPS140 zips. — [src/cmd/go/internal/modfetch/fetch.go#L40-110](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/modfetch/fetch.go#L40-L110) [go.env](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/go.env)
- vcs.go executes git/hg/svn/fossil binaries against module-controlled repo URLs; scheme security is enforced via isSecureScheme (https/ssh only) and honors GIT_ALLOW_PROTOCOL, but repo-root discovery parses remote HTML/meta tags via cmd/go/internal/web. — [src/cmd/go/internal/vcs/vcs.go#L35-140](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/vcs/vcs.go#L35-L140) [src/cmd/go/internal/web](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/web)
- cgo compiles package-supplied C/C++/Fortran and runs pkg-config and swig; buildFlags validates #cgo flags (security against flag injection), DefaultCFlags='-O2 -g'; malicious module C sources execute at build time. — [src/cmd/go/internal/work/exec.go#L54](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/work/exec.go#L54) [src/cmd/go/internal/work/exec.go#L3319-3381](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/work/exec.go#L3319-L3381) [src/cmd/go/internal/work/exec.go#L3838-4100](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/work/exec.go#L3838-L4100)
- The scheduler has many hard invariants enforced by throw() — 'schedule: holding locks', 'schedule: in cgo', 'runtime.main not on m0', 'nanotime returning zero' — a violation crashes the whole program; the spinning-thread protocol comment documents known underutilization race windows. — [src/runtime/proc.go#L86-104](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/runtime/proc.go#L86-L104) [src/runtime/proc.go#L4154-4178](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/runtime/proc.go#L4154-L4178) [src/runtime/proc.go#L191-200](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/runtime/proc.go#L191-L200)
- GC correctness depends on write-barrier discipline; the compiler's nowritebarrierrec check (ssagen.EnableNoWriteBarrierRecCheck/NoWriteBarrierRecCheck) runs only when compiling the runtime — a fragile coupling between compiler flags and runtime safety. — [src/cmd/compile/internal/gc/main.go#L303-309](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/compile/internal/gc/main.go#L303-L309) [src/cmd/compile/internal/gc/main.go#L370-373](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/compile/internal/gc/main.go#L370-L373) [src/runtime/mgc.go#L33-44](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/runtime/mgc.go#L33-L44)
- Bootstrap requires trusting a prebuilt Go >= 1.26.0 (GOROOT_BOOTSTRAP); make.bash refuses GOROOT_BOOTSTRAP==GOROOT but cannot verify provenance — classic trusting-trust exposure; GOEXPERIMENT is deliberately forced to 'none' for toolchain1 to avoid skew. — [src/make.bash#L67-194](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/make.bash#L67-L194) [src/cmd/dist/build.go#L966-978](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/dist/build.go#L966-L978)
- make.bash contains environment probes that can block or corrupt builds: gold 2.20 ld detection, SELinux allow_execstack check, src/pkg staleness fatal in cmdbootstrap — build failures here are environment-specific and hard to reproduce. — [src/make.bash#L97-129](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/make.bash#L97-L129) [src/cmd/dist/build.go#L980-988](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/dist/build.go#L980-L988)
- //go:linkname and unsafe let user code bypass type safety into runtime internals; linker flag -checklinkname (default true) exists specifically to police linkname references, indicating a known abuse vector; test/linkname.dir exercises it. — [src/cmd/link/internal/ld/main.go#L103](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/link/internal/ld/main.go#L103) [src/unsafe](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/unsafe)
- Telemetry writes counter files and spawns upload sidecars (MaybeChild/MaybeParent) — privacy-sensitive surface; special-cased so 'go telemetry off' works without opening counter files, and cmdIsGoTelemetryOff scans os.Args pre-parse. — [src/cmd/go/main.go#L98-114](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/main.go#L98-L114) [src/cmd/go/main.go#L223-256](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/main.go#L223-L256)
- Removed GODEBUG settings produce a fatal() at program startup — a deliberate compat break that can kill binaries built with older defaults if the env carries stale settings. — [src/runtime/proc.go#L220-225](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/runtime/proc.go#L220-L225) [doc/godebug.md](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/doc/godebug.md) [src/internal/godebugs/table.go](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/internal/godebugs/table.go)
- api/ files are a contractual freeze: adding to a released go1.N.txt is forbidden (files 'add new lines but do not remove any'), and post-1.19 entries must cite a proposal issue — editing the wrong file silently breaks the compatibility checker. — [api/README](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/api/README)
- Two parallel type checkers exist (go/types in std and cmd/compile/internal/types2 for the compiler) that must be kept in sync; skew between them is a recurring correctness risk. (inferred) — [src/go/types](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/go/types) [src/cmd/compile/internal/types2](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/compile/internal/types2)
- Generated files must stay in sync with generators: flagdefs.go (from genflags.go), opGen.go/rewrite rules in ssacompile, and files produced by writeGeneratedFiles in dist; editing outputs without regenerating causes subtle drift. (inferred) — [src/cmd/go/internal/test/genflags.go](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/go/internal/test/genflags.go) [src/cmd/compile/internal/ssacompile/opGen.go](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/compile/internal/ssacompile/opGen.go) [src/cmd/dist/build.go#L995](https://github.com/golang/go/blob/12c76d447f576e6c14c566c8524c13a0c0d476b9/src/cmd/dist/build.go#L995)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)