Dependency Management and Security in Go

IntermediateFree5 modules · 15 lessons

About this course

Go resolves dependencies unlike every other ecosystem in a polyglot estate, and this course explains the mechanism properly rather than by analogy. You will cover module paths tied to repository URLs, minimal version selection, what the module file and the checksum file each pin, the module proxy and the checksum database, vendoring, major version suffixes, retraction and deprecation, and the standard library fixes that arrive only with a toolchain upgrade. It closes with overriding a vulnerable transitive dependency, reading the build information a binary carries about itself, and the Go appendix of a policy that has to work across many ecosystems.

What you'll learn

The Module System and Minimal Version Selection

Import Paths, Repository URLs and One Global Namespace
Minimal Version Selection, and Why Go Resolves Unlike Everything Else
go.mod and go.sum: What Each One Actually Pins

The Proxy, the Checksum Database and Private Code

The Module Proxy and What Immutability Buys You
The Checksum Database and the Transparency Log
Private Modules, Internal Paths and the Shadowing Question

What Runs, What Cannot, and Where the Risk Moved

No Install Scripts: The Attack Class That Is Absent
What Replaced It: Build Constraints, Generation, the Foreign Function Interface and the Toolchain
Vendoring: When It Is Still the Right Answer

01The Module System and Minimal Version Selection3 lessons

Import Paths, Repository URLs and One Global Namespace
Minimal Version Selection, and Why Go Resolves Unlike Everything Else
go.mod and go.sum: What Each One Actually Pins

02The Proxy, the Checksum Database and Private Code3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Versions, Retraction and the Standard Library Boundary

Major Version Suffixes and the Import Compatibility Rule
Retracted Modules, Deprecation and How a Fix Reaches You
The Standard Library Boundary and Fixes That Arrive With the Toolchain

Practice: Overrides, Reproducibility and Upgrades

Overriding a Vulnerable Transitive Dependency
Reproducibility, Build Information and Verifying What Shipped
Upgrading a Module Several Major Versions Behind, and One Policy Across Ecosystems

The Module Proxy and What Immutability Buys You

The Checksum Database and the Transparency Log

Private Modules, Internal Paths and the Shadowing Question

03What Runs, What Cannot, and Where the Risk Moved3 lessons

No Install Scripts: The Attack Class That Is Absent
What Replaced It: Build Constraints, Generation, the Foreign Function Interface and the Toolchain
Vendoring: When It Is Still the Right Answer

04Versions, Retraction and the Standard Library Boundary3 lessons

Major Version Suffixes and the Import Compatibility Rule
Retracted Modules, Deprecation and How a Fix Reaches You
The Standard Library Boundary and Fixes That Arrive With the Toolchain

05Practice: Overrides, Reproducibility and Upgrades3 lessons

Overriding a Vulnerable Transitive Dependency
Reproducibility, Build Information and Verifying What Shipped
Upgrading a Module Several Major Versions Behind, and One Policy Across Ecosystems

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.