a private Go module proxy that remembers
Point GOPROXY at gastropod and get a private module proxy, a
caching mirror of the public Go module ecosystem, and a place to host your own private
modules, plus the part every other proxy leaves out: it verifies what it serves, remembers
what it saw, and can tell you who pulled what.
connecting is as easy as
GOPROXY=https://gastropod.io/go,direct GONOSUMCHECK=0
That's the whole integration. go build and
go get resolve through gastropod: public modules proxy from the upstream Go
module mirror and cache on first pull; your own modules publish to a hosted repo. No plugin,
no wrapper, no new CLI.
what happens on every fetch
- Identity is fixed. The module resolves to an exact PURL, version, and sha256 digest, not just a module path and a version tag.
- Provenance is verified. Gastropod checks the fetched module against
Go's own checksum database (
sum.golang.org) and Sigstore attestations where publishers provide them, before it's served. A module whose contents don't match its recorded checksum is flagged, not delivered. - Advisories are correlated. Known OSV advisories attach to the exact version, along with everything downstream of it, so when the next Go advisory is published, you already know every module and consumer it reaches.
- The pull is recorded. Who pulled it, when, and from where, attributed to a principal on the audit spine and exportable on request.
- It's remembered. SBOM, findings, provenance, and dependents stay attached to that digest. The next fetch of the same module, by any team or pipeline, inherits all of it.
the checksum database is the trust boundary
Go's module system already leans on a public checksum database to
detect a module that changes after publication, which is a stronger baseline than most
ecosystems start with. The gap most teams have isn't verification, it's memory: the same
module gets re-resolved and re-scanned in every repo, every pipeline, every team, because
nothing records that the check already happened. Gastropod checks each module against
sum.golang.org once per digest and keeps the result attached to that exact
digest, so the next fetch anywhere in your organization inherits it instead of repeating the
check from scratch.
proxy, hosted, virtual
proxy
A caching mirror of the public Go module ecosystem. The first fetch pulls and verifies; repeat fetches of the same digest serve from content-addressed, deduplicated storage.
hosted
Your own private modules, token-gated, with reader and publisher roles.
virtual
One GOPROXY value aggregating both, so a
single environment variable covers public and private resolution in the right order.
Every feature is on every tier, so none of this is an upsell: OIDC SSO, scoped tokens, SBOMs, advisories, blast radius, and the audit spine are all present starting at our published rates.
FAQ
how do I point Go at a private module proxy?
Set GOPROXY to your gastropod instance, with ,direct
as a fallback if you want unresolved modules to go straight to their source. Authentication
uses a standard .netrc entry or GOPROXY credentials, per Go's own
module-auth convention.
can I host private Go modules on gastropod?
Yes. Create a hosted repository and push your module the way you'd push to any private module host. Modules are private by default and readable only with a token.
does gastropod scan Go modules for vulnerabilities?
It verifies and correlates rather than replacing your scanner: each module is checked against Go's checksum database at intake, OSV advisories attach to each exact version, and findings from scanners you already run — Trivy, Grype, Snyk, Anchore — pin to the module so they follow it everywhere it appears.
can gastropod replace my current Go module proxy?
Yes, for standard Go workflows. Switching is a GOPROXY change,
not new tooling, and it runs side by side with your current proxy during evaluation.
Part of the full product overview. Also speaking: OCI · npm.
Go is a trademark of Google LLC. Gastropod is not affiliated with Google. Details current as of July 2026.