Module Monitoring

Source Spotter records every module version served by the Go Module Mirror and Checksum Database. You can subscribe to an Atom feed of those observations to make sure the module mirror is faithfully serving the same versions that you have released.

If you're interested in email or webhook notifications, consider GopherWatch.

Atom Feed

The feed is available at https://feeds.api.sourcespotter.com/modules/versions.atom. It returns up to 10,000 versions (excluding pre-release versions) ordered by the time we observed them.

The feed accepts the following query parameters:

module (required) – the module path to inspect. Append a trailing slash (/) to match all modules with the given prefix.
mldsa (optional) – the hex-encoded SHA-256 hash of an ML-DSA public key. When supplied, the feed only returns versions that have not been authorized by that key (see below).

For example, requesting ?module=example.com/module returns the versions of exactly that module, while ?module=example.com/ returns every module whose path starts with example.com/.

Try It Out

Enter the module path and optional ML-DSA public key hash to open the feed.

Authorizing Versions (Experimental)

Source Spotter can accept go.sum files signed by an ML-DSA key to mark module versions as authorized. When you supply the SHA-256 hash of the public key via the mldsa parameter, the feed filters out the versions that have already been authorized, allowing you to focus on unexpected releases.

To upload an authorization, POST the JSON serialization of the following Go struct to https://v1.api.sourcespotter.com/modules/authorized:

struct {
	MLDSA     []byte // Raw ML-DSA public key used to verify Signature
	GoSum     string // A go.sum file listing authorized module versions
	Signature []byte // ML-DSA signature over GoSum with an empty context string
}

You can use the sourcespotter-authorize command to authorize module versions in a local Git repository. Typically, you would run sourcespotter-authorize right after you run git tag to release a new version.

Install the command:

$ go install software.sslmate.com/src/sourcespotter/cmd/sourcespotter-authorize@latest

Generate a new key (stored in $XDG_CONFIG_HOME/sourcespotter-authorize/private_key by default):

$ sourcespotter-authorize -keygen

Print the public key hash (hex):

$ sourcespotter-authorize -pubkey

Print the URL for the current module's Atom feed:

$ sourcespotter-authorize -feed

Authorize a specific tag (or submodule tag like subdir/v1.2.3):

$ sourcespotter-authorize v1.2.3

Authorize every tag in the repository:

$ sourcespotter-authorize $(git tag)