golang.org/x/exp/sumdb - Go Module Sum Database Verification

import (
    "golang.org/x/exp/sumdb/internal/note"
    "golang.org/x/exp/sumdb/internal/sumweb"
    "golang.org/x/exp/sumdb/internal/tkv"
    "golang.org/x/exp/sumdb/internal/tlog"
)

package main

import (
    "fmt"
    "log"
    "os"
    "os/exec"
)

func main() {
    // Using gosumcheck tool to verify go.sum against database server
    // gosumcheck checks a go.sum file for correctness against the
    // Go checksum database server

    // Command line usage (recommended):
    // gosumcheck -u https://sum.golang.org -k 3+b+DNQhBUhNtjeDVVw/QvT6aE8jQlklKSnoG0q2sL7lMTm92ZvHoDh04I8Fd2yI2H3 go.sum

    // For programmatic access, use the gosumcheck tool directly
    cmd := exec.Command("gosumcheck", "-v", "go.sum")
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr

    if err := cmd.Run(); err != nil {
        log.Fatal(err)
    }
}

// gosumcheck tool: checks a go.sum file against a go.sum database server
//
// Usage:
//    gosumcheck [-h H] [-k key] [-u url] [-v] go.sum
//
// Flags:
//    -h H     Tile height (default 8) - controls the structure of the
//             Merkle tree used for the tamper-evident log
//    -k key   Database server key for signature verification
//    -u url   Override the URL of the server (usually derived from key name)
//    -v       Enable verbose output, showing URLs and elapsed time for requests
//
// Examples:
//    gosumcheck go.sum
//    gosumcheck -v go.sum
//    gosumcheck -u https://sum.golang.org go.sum
//    gosumcheck -h 8 -k <key> go.sum

WARNING! WARNING! WARNING!

Gosumcheck is meant as a proof of concept demo and should NOT be used in
production scripts or continuous integration testing because:

1. It does not cache downloaded information from run to run, making it
   expensive to run repeatedly
2. It cannot detect server misbehavior or successful HTTPS man-in-the-middle
   timeline forks
3. It does not set any exit status to report whether problems were found,
   making it unsuitable for automation

For production use, integrate checksum verification directly into your
build pipeline using the Go toolchain's built-in module verification.

# Basic verification of go.sum file
gosumcheck go.sum

# Verbose output showing all network requests
gosumcheck -v go.sum

# Verify against specific server URL
gosumcheck -u https://sum.golang.org go.sum

# Custom tile height for Merkle tree structure
gosumcheck -h 8 -k "3+b+DNQhBUhNtjeDVVw/QvT6aE8jQlklKSnoG0q2sL7lMTm92ZvHoDh04I8Fd2yI2H3" go.sum

# Full example with all flags
gosumcheck -h 8 -k <server-key> -u https://sum.golang.org -v go.sum

// Internal package: golang.org/x/exp/sumdb/internal/note
//
// The note package provides:
// - Note format specification following RFC standards
// - Cryptographic signing with Ed25519
// - Signature verification and validation
// - Multi-signature support for signed notes
// - Note encoding and decoding
//
// Not intended for direct public use; used internally by tlog and sumweb

// Internal package: golang.org/x/exp/sumdb/internal/tlog
//
// The tlog package provides:
// - Merkle tree-based append-only log structure
// - Proof generation and verification
// - Tree hash computation
// - Efficient snapshot management
// - Leaf and tree node operations
//
// Not intended for direct public use; used internally by sumweb

// Internal package: golang.org/x/exp/sumdb/internal/tkv
//
// The tkv package provides:
// - Tile-based key-value storage
// - Merkle tree with tiles for scalability
// - Efficient partial tree downloads
// - Proof generation and verification
// - Tile hash computation and caching
//
// Not intended for direct public use; used internally by sumweb

// Internal package: golang.org/x/exp/sumdb/internal/sumweb
//
// The sumweb package provides:
// - HTTP server for serving sum database tiles
// - HTTP client for querying sum database
// - Tile download and caching
// - Latest log checkpoint retrieval
// - Module checksum lookup
// - Signature verification
//
// Not intended for direct public use; used by tools and libraries

// 1. Read a go.sum file
// 2. Connect to the checksum database server
// 3. Fetch the latest tree head (checkpoint)
// 4. For each module in go.sum:
//    - Look up the module's checksum in the database
//    - Compare with go.sum entry
//    - Verify the lookup proof
// 5. Report any mismatches or verification failures

// All data entries (module checksums) are stored as leaves in a Merkle tree
// Each leaf is hashed, then pairs are combined to form parent nodes
// The root hash (tree hash) represents the entire state of the database
// A proof path from a leaf to the root can verify membership without
// downloading the entire tree

// The database is organized into tiles - small Merkle trees
// Each tile contains multiple key-value entries
// Tiles can be independently verified and cached
// Only the minimum necessary tiles are downloaded for verification
// Parent tiles connect child tiles into a complete tree structure