Webhooks · 9 min read
Webhook signature checks that fail or quietly pass in Go
Avoid the mistakes that break or weaken webhook signature checks in Go, and see how GitHub, Stripe and Standard Webhooks differ in practice.
Posts tagged “go”
15 articles about go.
Webhooks · 8 min read
A durable webhook retry queue in SQLite
Build a webhook job queue on one SQLite table: claim work with leases, retry with jittered backoff, dead-letter poison events and replay them safely.
Webhooks · 8 min read
Verify Standard Webhooks (Polar) signatures in Go
Write a dependency-free Go verifier for Standard Webhooks signatures as used by Polar, with secret rotation, replay protection and a known-answer test.
Packaging and releasing CLIs · 10 min read
Verify a downloaded binary: checksums, GPG, minisign, cosign
Learn what sha256sum, GPG, minisign and cosign each protect against, how to verify a release by hand, and how an installer should chain the checks.
Deploys and releases · 9 min read
What a plain systemctl restart costs a Go service under load
We sent 20 requests per second through Caddy while restarting a Go service. About one in four failed. Measure your own restart, then pick a fix that fits.
Deploys and releases · 9 min read
systemd socket activation: no dropped requests, but a cost
Socket activation let a Go service restart without refusing a connection, but slow requests waited over five seconds. Setup, code, and when to use it.
Packaging and releasing CLIs · 11 min read
Reproducible Go builds: build twice, compare the hashes
Build the same Go commit in two directories, compare the bytes, and learn which flags and settings make the hashes match or differ.
Webhooks · 9 min read
Receiving signed webhooks in Go with a durable queue
Build a webhook receiver in Go that verifies signatures, dedupes deliveries, stores events in SQLite and processes them with retries, on one VPS.
Go in production · 10 min read
Graceful shutdown for a Go HTTP server under systemd
Handle SIGTERM with signal.NotifyContext, drain requests with Server.Shutdown, stop workers cleanly and set TimeoutStopSec so systemd waits long enough.
Packaging and releasing CLIs · 11 min read
A GoReleaser v2 config for a small Go CLI, line by line
Write a .goreleaser.yaml for a one-binary Go CLI covering builds, archives, checksums, version ldflags and changelog, and publish to GitHub or GitLab.
Go in production · 10 min read
GOMEMLIMIT in an 80 MB container, with the numbers
A Go program with 40 MiB of live data was OOM-killed in an 80 MiB container. See what GOMEMLIMIT fixes, what it costs in CPU, and where the limit is soft.
Go in production · 9 min read
Go SQLite reads returning 404 for rows that exist
Under load, a Go service answered 404 for rows it had just written. How we found it, the regression test that catches it, and what to check in your pool.
Go in production · 10 min read
log/slog setup for a small Go service on journald
Configure log/slog with JSON or text output, a runtime log level, request ids on every line, secret redaction, and queries that work in journalctl.
Go in production · 10 min read
Go HTTP server timeouts that survive slow and stuck clients
Set ReadHeaderTimeout, ReadTimeout, WriteTimeout and IdleTimeout correctly, add per-handler deadlines, and prove a slowloris client gets cut off.
Packaging and releasing CLIs · 10 min read
What a curl | sh installer for a Go binary should refuse
Write an install script for a Go release that stops on a bad checksum, odd version, plain http or unknown platform, and test each refusal.