Hacker News Reader

Comment by protomyth | Hacker News Reader

Can someone give a decent explanation of the following:

1) Supposed I have a library that was written in C that receives a security update which is used in a Go program. Under what conditions do I need to get a recompiled version of the Go program.

2) Supposed I have a library that was written in Go that receives a security update which is used in a Go program. Under what conditions do I need to get a recompiled version of the Go program.

3) Is there a way to tell from the binary that the program was written in Go?

Trying to figure this out for my Sys Admin dealing with Vendors role.

View on HN

1) If my understanding is correct, you won't need a new Go binary. You can simply update the library, Go just links to it. Go even links to libraries if you use certain packages from the standard library, e.g. `os/user`:

    $ cat homedir.go
    package main
    
    import (
            "fmt"
            "os/user"
    )
    
    func main() {
            fmt.Println(user.Current())
    }

    $ go build homedir.go

    $ otool -L homedir
    homedir:
            /usr/lib/libSystem.B.dylib (compatibility version 0.0.0, current version 0.0.0)
            /usr/lib/libSystem.B.dylib (compatibility version 0.0.0, current version 0.0.0)

2) You (most likely) have to recompile and re-deploy the downstream Go program with the patched library. 3) Not sure.

3) A compiled Go binary contains the import paths of all used libraries plus all variable names that they are using. Also the header of the binary contains a string like "Go" followed by a hash. If you open a binary in a Hex Editor you will see it yourself.

So I should be able to write a program or one already exists to check if its a Go program and what its dependencies are.

1) Was this static C library? Then you need to recompile. If it was dynamic then the question is did abi change? If yes, you need to recompile, otherwise you don't (but security updates usually don't break abi).

2) Always.

3) Yes, Go runtime is linked in to executables build with Go.

Does Go include external libraries (stuff not written in Go) as dynamic links or static?

It's up to you to decide how/what you want to link, just like in C. I've prepared simple example at https://github.com/tumdum/go_libs that you can use to see how exactly it's all working.

Thank you, its much appreciated.

Best to assume that you will need to recompile a Go program yourself. If you don't have the source and know how to build it, you're in trouble.

I am a bit worried about accepting software from vendors written in Go given those circumstances. For example, the recent OpenSSL patches would be an example. Are the Go programs fine if I update OpenSSL or did they include OpenSSL's libraries statically? If someone writes a Go replacement for OpenSSL does that change the scenario.

Given a lot of software makes it to my door written by government contractors for grant management / compliance, I don't have the source code.

Go has its own crypto library that's maintained by a real crypto expert so that might not be the best example. Still, if they do find a bug, there will be a new release of Go and you (or your supplier) should be prepared to recompile.

Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices.

> Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices.

Well, since I cannot just patch a library, I am a lot more worried about the implications of Go programs being the "unmaintainable, unfixable binaries".

Reply on news.ycombinator.com