Does the Go SDK even have any third-party dependencies? How could something like the XZ backdoor happen? Also, given that Go binaries are statically linked, if

Does the Go SDK even have any third-party dependencies? How could something like the XZ backdoor happen? Also, given that Go binaries are statically linked, if you can't rebuild from source, you're screwed. You need to get good at building from source.