Good point, linked!

Well it looks like this answers the question I posited above. Very interesting work, surprised I hadn't seen it.

As I said there, Wheeler was exemplary for handling most of this right ahead of time. He gave credit to Karger for inventing the compiler subversion attack. He wrote the reference page on high-assurance FLOSS (for compiler verification) and high-assurance SCM (for repo security, esp distribution). He also wrote a cheat I gripe about in reproducible builds to give us something to work with if high-assurance methods get ignored. Any of his stuff on this subject is worth reading.

Here's his high-assurance and SCM pages:

http://www.dwheeler.com/essays/high-assurance-floss.html

http://www.dwheeler.com/essays/scm-security.html

Thanks!

It shouldn't be hard, and I've played with the Go AST before. I ... could :)

This was sort of a bucket list thing though, doing it a second time is less fun :p And I don't have that much time.

Why don't you try? The technique explained in the blog post is pretty universal. Go has an AST too, and while the Folder abstraction doesn't exist in its codebase (as far as I know), you can still tweak the AST. In the case of Go it would be easier to do the injection during parsing. https://github.com/golang/go/blob/5c9035acc1e1540a564ea66000... would be a good entry point. https://golang.org/pkg/go/ast/ should help.

(I am not a Go compiler dev so there may be better entry points)