32-bit
wixmachine scopego.dev · publisher domain- SHA-256
- fe20b9d7cc23c9f1afb702a7f04161d75055cd6d58c783d9ad3381e4e83fe9b8
- Product code
- {4FFF969B-44D4-46E5-A73A-589331513BDF}
by https://go.dev · BSD-3-Clause
An open source programming language that makes it simple to build secure, scalable systems.
These URLs are the ones https://go.dev declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what https://go.dev published. Delete it.
Windows · PowerShell
Get-FileHash "go1.26.5.windows-amd64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "go1.26.5.windows-amd64.msi"Expected output
d554dc209403b101225fc2b54647ef47df09bea23291b1246fe1b35198f55f50
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | BSD-3-ClauseA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Go Programming Language registers itself to handle.
Every version with a published manifest, newest first. Useful when you need an older build for compatibility.