v2.0.0

What's Changed

• gomodjail v2: move the focus to static analysis by @AkihiroSuda in #123

Full Changelog: v1.0.0...v2.0.0

Usage

See https://github.com/AkihiroSuda/gomodjail/blob/v2.0.0/README.md

gomodjail can be applied just in the following two steps:

Step 1: add gomodjail:confined comment to go.mod:

require (
        example.com/module v1.0.0 // gomodjail:confined
)

Step 2: statically verify the confinement with gomodjail analyze:

gomodjail analyze ./...

The build fails (non-zero exit) if a confined module's code can reach a
denied capability: filesystem, network, process execution, raw syscalls,
OS state modification, or cgo.

The legacy dynamic mode (gomodjail run), which enforces a similar (but
not identical) policy at runtime via syscall interception, is still
available — see Dynamic mode.

---

The binaries were built automatically on GitHub Actions.
The build log is available for 90 days: https://github.com/AkihiroSuda/gomodjail/actions/runs/34277622929

The sha256sum of the SHA256SUMS file itself is 1e42ab2f068d347d58d0728f9834567d05b46ec9b3018b919e5aa64031d4a991 .