Pre-launch cleanup: fix 5 issues from production readiness review#1
Merged
Conversation
added 4 commits
March 14, 2026 00:11
![clap [bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
go.mod requires 1.24.0 but CI and release workflows used 1.22. Also add SHA-256 checksum generation to release workflow.
The README only documented 5 canary types but the code supports 13. Added all types with accurate locations, triggers, and reliability. Also added warning notes about PyPI and npm global config side effects, and removed already-implemented items from the roadmap.
Downloads the .sha256 checksum file from the release and verifies the binary integrity before installation. Supports both sha256sum (Linux) and shasum (macOS). Fails with a clear error if checksums don't match. A security tool should verify its own downloads.
Covers all token generators: NewID, NewAWSKeyID, NewAWSSecretKey, NewGitHubToken, NewStripeKey, NewOpenAIKey, NewAnthropicKey, NewK8sToken, NewNPMToken, NewFakeRSAPrivateKey, NewGCPProjectID, NewGCPClientID, NewGCPPrivateKeyID, and MustRandInt. Tests verify: - Format correctness (prefix, length, charset) - Uniqueness (no collisions across 1000 generations) - Minimum length requirements (MinTokenLen) - No giveaway strings (SNARE, FAKE, TEST, etc.) in any output - PEM structure for RSA keys - JWT structure for K8s tokens - Range and distribution for MustRandInt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses 5 critical items from the production readiness review.
Changes
Fix go.mod/CI version mismatch — CI and release workflows used Go 1.22 but go.mod requires 1.24. Aligned both workflows to 1.24.
Update README canary types table (5 → 13) — The README only documented 5 canary types (aws, gcp, github, stripe, generic) but the code supports 13. Added all types with accurate locations, triggers, and reliability ratings. Also removed already-implemented items (OpenAI/Anthropic, K8s) from the roadmap.
Add SHA-256 checksum verification to install script — The install script now downloads the
.sha256checksum file from the release and verifies the binary before installation. Supports bothsha256sum(Linux) andshasum(macOS). Also added checksum generation to the release workflow.Document PyPI/npm global config side effects — Added warning callouts in the README explaining that
snare plant --type pypimodifies global pip config (affects allpip installcommands) and--type npmmodifies~/.npmrc(affects scoped packages). Users need to know these canaries have side effects on real workflows.Add comprehensive tests for the token package — 366 lines of tests covering all token generators. Tests verify format correctness, uniqueness (1000-iteration collision checks), minimum length requirements, no giveaway strings (SNARE/FAKE/TEST/etc.), PEM structure, JWT structure, and RNG distribution.
Test results
All tests pass with
-race -count=1.