Go 1.15 Released
golang.org
Go 1.15 Released
1–10 of 74 posts
Re: Go 1.15 Released
#2Where are signatures for these binaries published?
Re: Go 1.15 Released
#3It seems it hasn't received a blog post/entry in the release history yet
Re: Go 1.15 Released
#4Where are signatures for these binaries published?
Scroll down a bit, they're on that page.
Re: Go 1.15 Released
#5It seems it hasn't received a blog post/entry in the release history yet
[deleted]
Re: Go 1.15 Released
#6It seems it hasn't received a blog post/entry in the release history yet
Will be similar to what's in the tip: https://tip.golang.org/doc/go1.15
Re: Go 1.15 Released
#7Where are signatures for these binaries published?
The sha256 sums are in the table, scroll across if you're on mobile. I don't recall ever seeing signatures though
Would love to know if they're there and I've missed them.
Re: Go 1.15 Released
#8Where are signatures for these binaries published?
I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz`, couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/`?
Re: Go 1.15 Released
#9Anyone know why https://go.dev still has a download link for "1.14.6", and there's no mention of it over at golang.org?
Re: Go 1.15 Released
#10Where are signatures for these binaries published?
I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?
They are for integrity checking, not security. PGP signatures are better for the scenario you are describing.