Supply Chain and Dependencies

Updated

September 8, 2026

Supply Chain and Dependencies

Overview

Your binary includes every module you import. Supply-chain hygiene: pin versions, review updates, scan vulns, reproduce builds.

Minimal practices

Practice Tool / habit
Modules go.mod / go.sum committed
Vuln scan govulncheck ./...
Minimal deps resist “one function” modules
Checksums go.sum authenticity via sumdb
CI fail on known critical vulns 
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

go.mod hygiene

go get module@vX.Y.Z   # explicit
go mod tidy
go mod download

Prefer semantic import versions and avoid replace to random forks in production without review.

Vendoring (optional)

go mod vendor
# build with -mod=vendor for airgapped CI

Reproducible builds

CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=$VER"

Document Go version (toolchain line in go.mod).

Private modules

GOPRIVATE=github.com/myorg/*

Don’t leak private paths to public proxies.

Rules of thumb

Do Don’t
Run govulncheck in CI Ignore go.sum conflicts blindly
Review upgrades Auto-merge major deps without tests
Pin actions SHA in CI uses: foo@main for build

Try next

  1. Run govulncheck on this repo’s modules.
  2. Add CI step.
  3. Build with -trimpath and compare reproducibility notes.