Go on

Chainguard Libraries for Go overview

Fri, 25 Sep 2026 00:00:00 +0000

Chainguard Libraries for Go provides enhanced security for the Go module ecosystem through an authenticated, secure-by-default Go module proxy. The proxy applies organization-defined policies, malware and greyware protections, cooldown controls, and CVE remediation to Go dependencies before they reach development and build environments.

Go modules support cloud-native infrastructure, high-volume services, fintech, networking, and security applications. Chainguard Libraries for Go helps reduce the risks of consuming modules from public sources, including malicious modules, typosquats, and vulnerabilities in versions your applications still need to use.

Global configuration

Fri, 25 Sep 2026 00:00:00 +0000

Go module consumption in a large organization is typically managed by a repository manager. The repository manager acts as a single point of access for developers and development tools to retrieve Go modules.

Configure Artifactory with a single remote repository pointed at https://libraries.cgr.dev/go/. Chainguard Repository handles upstream fallback and policy enforcement; Artifactory handles local caching, access control, and the endpoint used by your Go toolchains.

JFrog Artifactory

JFrog Artifactory supports Go repositories for proxying and hosting Go modules, and virtual repositories for combining sources into one endpoint. Refer to the Go repositories documentation for Artifactory for more information.

Configure Go build tools

Fri, 25 Sep 2026 00:00:00 +0000

Chainguard Libraries for Go implements the standard GOPROXY protocol. To use it, configure Go to retrieve modules through the Chainguard Go module proxy.

This page is a reference for configuring Go projects and CI/CD environments. It covers authentication, proxy configuration, cache clearing, verification, and using Chainguard-remediated module versions. Apply these changes on every workstation and build server that downloads Go modules, including CI/CD systems such as GitHub Actions, Jenkins, and TeamCity.

Migrating a Go project to Chainguard Libraries

Fri, 25 Sep 2026 00:00:00 +0000

Chainguard Libraries for Go provides an authenticated Go module proxy that applies Chainguard security controls to Go dependencies.

Because Chainguard Libraries uses the standard GOPROXY protocol, migrating an existing project does not require application-code changes or a new dependency declaration format. You configure the Go toolchain to use Chainguard, refresh any cached modules, and verify the build.

This guide covers two common setups:

Direct access: Your Go toolchain connects directly to libraries.cgr.dev. This is useful for an evaluation, a small team, or an isolated CI job.
Repository manager: Your Go toolchain connects to a repository manager that proxies Chainguard Libraries. This is recommended for organization-wide use.

Prerequisites

Before you begin, you need: