Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go 1.15 Released

golang.org

Post reply on HN
Print view View original

11–20 of 74 posts

Re: Go 1.15 Released

#11

Post by TallGuyShort »

throwaway43234 wrote: post #8
xorcist wrote: post #2

Where are signatures for these binaries published?

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

With very large, very important downloads, I also appreciate a quick check that no corruption or loss was involved in the download for benign reasons either.

Re: Go 1.15 Released

#12

Post by Foxboron »

xorcist wrote: post #2

Where are signatures for these binaries published?

Source tarball: https://storage.googleapis.com/golang/go1.15.src.tar.gz

Signature: https://storage.googleapis.com/golang/go1.15.src.tar.gz.asc

Signed with `EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796` which is the Google Linux Packages Signing Authority.

EDIT: I realized you wanted the binaries.

You can fetch them from "https://dl.google.com/go/go1.15.linux-amd64.tar.gz.asc", append `.asc` to the binary I reckon.

Signed with the same key as the source release.

Re: Go 1.15 Released

#13

Post by dr_hooo »

throwaway43234 wrote: post #8
xorcist wrote: post #2

Where are signatures for these binaries published?

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

You can calculate the signature offline on your local machine against the public key - only the owner of the file can generate a valid signature

Re: Go 1.15 Released

#14

Post by throwaway43234 »

_wldu wrote: post #10
throwaway43234 wrote: post #8

Earlier quoted context omitted.

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

They are for integrity checking, not security. PGP signatures are better for the scenario you are describing.

Is it a common scenario nowadays to download a file and have it be corrupted? I don't think I've ever had that happen (Though perhaps I wouldn't know, because I don't use these checksums! Though if a package is corrupted and it doesn't noticeably degrade, is it really corrupted? Hm... philosophy of internet downloads)

Re: Go 1.15 Released

#15

Post by throwaway43234 »

dr_hooo wrote: post #13
throwaway43234 wrote: post #8

Earlier quoted context omitted.

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

You can calculate the signature offline on your local machine against the public key - only the owner of the file can generate a valid signature

These aren't signatures though? They're checksums, anyone could make them for any blob they want.

Re: Go 1.15 Released

#17

Post by gautamcgoel »

benhoyt wrote: post #16

I think the link should be changed to the 1.15 release notes (now published): https://golang.org/doc/go1.15 -- these are much more interesting and useful.

Yes, I agree. No point on linking to the download page, most people use their package manager to update their Go installation.

Re: Go 1.15 Released

#18

Post by ainar-g »

quicklime wrote: post #9

Anyone know why https://go.dev still has a download link for "1.14.6", and there's no mention of it over at golang.org?

That website is updated separately, if I recall correctly. It will probably be updated later today.

Re: Go 1.15 Released

#20

Post by majewsky »

TallGuyShort wrote: post #11
throwaway43234 wrote: post #8

Earlier quoted context omitted.

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

With very large, very important downloads, I also appreciate a quick check that no corruption or loss was involved in the download for benign reasons either.

Has this actually happened to someone in the last 10 years?
Post reply on HN