7 ms·
Can someone give a decent explanation of the following: 1) Supposed I have a library that was written in C that receives a security update which is used in a G
by protomyth 11y ago
Can someone give a decent explanation of the following:
1) Supposed I have a library that was written in C that receives a security update which is used in a Go program. Under what conditions do I need to get a recompiled version of the Go program.
2) Supposed I have a library that was written in Go that receives a security update which is used in a Go program. Under what conditions do I need to get a recompiled version of the Go program.
3) Is there a way to tell from the binary that the program was written in Go?
Trying to figure this out for my Sys Admin dealing with Vendors role.
- skybrian 11y agoBest to assume that you will need to recompile a Go program yourself. If you don't have the source and know how to build it, you're in trouble.
- protomyth 11y agoI am a bit worried about accepting software from vendors written in Go given those circumstances. For example, the recent OpenSSL patches would be an example. Are the Go programs fine if I update OpenSSL or did they include OpenSSL's libraries statically? If someone writes a Go replacement for OpenSSL does that change the scenario. Given a lot of software makes it to my door written by government contractors for grant management / compliance, I don't have the source code.
- skybrian 11y agoGo has its own crypto library that's maintained by a real crypto expert so that might not be the best example. Still, if they do find a bug, there will be a new release of Go and you (or your supplier) should be prepared to recompile. Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices.
- protomyth 11y ago> Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices. Well, since I cannot just patch a library, I am a lot more worried about the implications of Go programs being the "unmaintainable, unfixable binaries".
- zenlikethat 11y ago1) If my understanding is correct, you won't need a new Go binary. You can simply update the library, Go just links to it. Go even links to libraries if you use certain packages from the standard library, e.g. `os/user`: $ cat homedir.go package main import ( "fmt" "os/user" ) func main() { fmt.Println(user.Current()) } $ go build homedir.go $ otool -L homedir homedir: /usr/lib/libSystem.B.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/libSystem.B.dylib (compatibility version 0.0.0, current version 0.0.0) 2) You (most likely) have to recompile and re-deploy the downstream Go program with the patched library. 3) Not sure.
- tumdum_ 11y ago1) Was this static C library? Then you need to recompile. If it was dynamic then the question is did abi change? If yes, you need to recompile, otherwise you don't (but security updates usually don't break abi). 2) Always. 3) Yes, Go runtime is linked in to executables build with Go.
- protomyth 11y agoDoes Go include external libraries (stuff not written in Go) as dynamic links or static?
- spacey 11y ago3) A compiled Go binary contains the import paths of all used libraries plus all variable names that they are using. Also the header of the binary contains a string like "Go" followed by a hash. If you open a binary in a Hex Editor you will see it yourself.
- protomyth 11y agoSo I should be able to write a program or one already exists to check if its a Go program and what its dependencies are.