go/goreleaser
go/goreleaser
1
0
Fork 0
mirror of https://github.com/goreleaser/goreleaser.git synced 2025-01-10 03:47:03 +02:00
Code Issues Releases Activity
36a48eabb7
goreleaser/www/docs/customization/verifiable_builds.md
Carlos Alexandro Becker 61f586e625
docs: version recent changes (#3367) 
versioned all new options since v1.2 (late 2021).

Should be enough to fix #3317 for now.

Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-09-11 16:54:51 -03:00

1.4 KiB
Raw Blame History

Verifiable Builds

GoReleaser has support for creating verifiable builds. A verifiable build is one that records enough information to be precise about exactly how to repeat it. All dependencies are loaded via proxy.golang.org, and verified against the checksum database sum.golang.org. A GoReleaser-created verifiable build will include module information in the resulting binary, which can be printed using go version -m mybinary.

Configuration options available are described below.

# goreleaser.yaml

gomod:
  # Proxy a module from proxy.golang.org, making the builds verifiable.
  # This will only be effective if running against a tag. Snapshots will ignore this setting.
  # Notice: for this to work your `build.main` must be a package, not a `.go` file.
  #
  # Default is false.
  proxy: true

  # If proxy is true, use these environment variables when running `go mod` commands (namely, `go mod tidy`).
  # Defaults to `os.Environ()`.
  env:
    - GOPROXY=https://proxy.golang.org,direct
    - GOSUMDB=sum.golang.org
    - GOPRIVATE=example.com/blah

  # Sets the `-mod` flag value.
  #
  # Default: empty.
  # Since: v1.7.
  mod: mod

  # Which Go binary to use.
  # Defaults to `go`.
  gobinary: go1.17

!!! tip You can use debug.ReadBuildInfo() to get the version/checksum/dependencies of the module.