> As for the rest, it would be cool if binaries shipped with a manifest of some sort naming all the versions of their statically included dependencies. A SBoM o

> As for the rest, it would be cool if binaries shipped with a manifest of some sort naming all the versions of their statically included dependencies. A SBoM of sorts. It would make this sort of vulnerability scanning much easier to do. Go binaries have that. You can apply "go version -m" to any recent Go binary. Also "govulncheck". Examples: go version -m $(which go) go install golang.org/x/vuln/cmd/govulncheck@latest go version -m $(which govulncheck) govulncheck -mode=binary $(which govulncheck) for b in $(go env GOPATH)/bin/*; do govulncheck -mode=binary "$b"; done