go | Hasty Briefs

Bilingual

Pgtestdb's template cloning approach to testing is fast
2 months ago
- pgtestdb is a Go/Postgres testing package that leverages Postgres template databases for fast test database cloning.
- Template database cloning is faster than migrating a test database from scratch and lighter than Docker-based approaches.
- River's test suite uses a schema-based isolation method that is slower than test transactions but has advantages like lighter weight than databases.
- Performance comparison showed similar setup times (~100ms) for both pgtestdb clone and create+migrate schema methods.
- River's schema-based approach achieved 3.5x faster overall wall time due to test schema pooling and reuse, which avoids re-migration.
- Schema reuse can be applied to pgtestdb as well, potentially reducing test setup to 10-20ms for large test suites.
- The author recommends pgtestdb for end-to-end testing but will keep River's schema-based method due to its incidental verification of schema configuration.
Giving your Go apps Tigris superpowers | Tigris Object Storage
2 months ago
- Tigris extends S3 with advanced features like bucket forking, snapshots, and object renaming, but using them with raw S3 calls requires boilerplate code.
- The new Go Storage SDK simplifies this by providing dedicated methods (e.g., RenameObject, BundleObjects) in two packages: `storage` and `simplestorage`.
- Package `storage` is a drop-in replacement for the AWS S3 client, adding Tigris-specific methods while keeping existing code compatible.
- Package `simplestorage` offers a reimagined high-level interface that infers bucket and credentials from environment variables, reducing cognitive load.
- `simplestorage` supports easy bucket forking via the `For` method and works with other S3-compatible providers like Hetzner.
- The SDK can be installed with `go get github.com/tigrisdata/storage-go@latest`, and feedback is welcomed for improvement.
How my minimal, memory-safe Go rsync steers clear of vulnerabilities
2 months ago
- A total of 12 security vulnerabilities were found in rsync across two batches (January 2025 and May 2026).
- Go's memory safety (bounds checks, zero initialization) and the os.Root API prevent or mitigate most vulnerabilities.
- gokrazy/rsync's minimal implementation avoids 8 of 12 vulnerabilities simply by not implementing vulnerable features.
- OpenBSD's openrsync also avoids many vulnerabilities due to minimalism and defense-in-depth (unveil, pledge).
- Defense in depth on Linux includes mount namespaces, systemd hardening, Landlock, and Go's os.Root API.
- All known vulnerabilities are fixed in gokrazy/rsync v0.3.3+ and upstream rsync 3.4.3+.
- The article concludes that lacking validation and complexity are primary causes of vulnerabilities.
- Simple use cases should use simple implementations to reduce attack surface.
Go Analysis Framework: modular static analysis by go team
2 months ago
- Package analysis defines an interface for modular static analysis of Go code, where an Analyzer inspects one package at a time and can save information from lower-level packages for use in higher-level ones.
- The core type Analyzer includes fields like Name, Doc, Run function, Requires (dependencies on other analyzers), ResultType, and FactTypes, enabling composition and reuse.
- A Pass represents a single analysis unit, providing type info, syntax trees, and methods to report diagnostics (via Report/Reportf) and manage facts (export/import).
- Facts are serializable intermediate results that allow cross-package analysis, similar to compiler export data, and must be encoded using gob for deterministic caching.
- The framework supports validation (Validate function), testing utilities (analysistest), and driver programs like singlechecker and multichecker to run analyzers as standalone commands.
Gsxui – Shadcn-style components for Go
2 months ago
- gsxui is a shadcn-style component set for gsx, a Go frontend framework.
- Components are copy-in, type-checked, and server-rendered, giving developers full ownership of the code.
- Style components with Tailwind CSS and ship them easily.
- Installation involves running 'go install' for gsxui, then 'gsxui init', and adding components like button with 'gsxui add button'.
Stinkpot: SQLite-Backed Shell History
2 months ago
- stinkpot is a minimal SQLite-backed shell-history searcher for bash, inspired by atuin but much smaller.
- It is written in Go (about 400 lines) and focuses only on session-agnostic history management and a TUI searcher.
- It can be installed via Nix home-manager or by evaluating an init script in .bashrc.
- Existing bash history can be imported with 'stinkpot import', and reverse search is triggered by Ctrl+R.
- The history database is stored in ~/.local/share/stinkpot; if upgrades break it, simply delete and reimport.
- The project includes performance improvements, using a covering index in SQLite for faster reverse search.
Escape Analysis in Go: Stack vs. Heap Allocations Explained
2 months ago
- Escape analysis in Go is a compiler optimization that determines whether a value should be allocated on the stack or the heap.
- Values escape to the heap when they are still needed after the function returns, such as when returning pointers, using closures or goroutines, passing values through interfaces, or storing in long-lived data structures.
- The Go compiler provides escape analysis insights via the 'go build -gcflags="-m"' command, but the output can be noisy and hard to interpret.
- GoLand's escape analysis tool integrates compiler output into the editor, making it easier to understand allocation decisions with gutter markers and organized logs.
- Escape analysis is most valuable for optimizing hot paths in performance-sensitive code, but not all heap allocations need optimization.
- Best practices include measuring performance first, focusing on hot paths, understanding escape reasons, and verifying changes with benchmarking.
Building the Pkg.go.dev TUI Explorer
2 months ago
- The new pkg.go.dev API provides programmatic access to package metadata, module versions, symbols, vulnerabilities, and more, eliminating the need for scraping HTML.
- The API is published with an official OpenAPI specification, making it easy to generate a Go client using tools like oapi-codegen.
- The author built a terminal UI (TUI) using Bubble Tea to browse Go documentation entirely from the terminal, improving workflow by avoiding context switching to a browser.
- The TUI currently supports searching packages, browsing module versions, and inspecting exported symbols, with potential for future features like vulnerability browsing and dependency trees.
- The generated API client had minor issues from the OpenAPI spec, which were fixed locally, and some response types needed manual extension.
- The application architecture separates state, networking, and rendering cleanly using Bubble Tea's message-driven model.
- The author highlights the API as a significant addition to Go tooling, enabling easier development of editor plugins, terminal tools, and automation.
Go-Flavored Concurrency in C
2 months ago
- Go's concurrency model is popular for its lightweight goroutines, channels, and efficient runtime scheduler, but replicating it in C using only POSIX threads presents trade-offs.
- Solod (So) implements a concurrency stack based on pthread primitives: sync.Mutex and sync.Cond wrap pthread_mutex_t and pthread_cond_t, providing basic synchronization.
- Atomic operations in So map directly to C's __atomic built-ins, matching Go's performance for load, store, and compare-and-swap operations without pthread overhead.
- So's conc.Pool uses a fixed number of worker threads with a shared task queue, built with mutexes and condition variables, suitable for coarse-grained workloads but not for thousands of blocked tasks like goroutines.
- Channels in So (conc.Chan[T]) support buffered and unbuffered modes, using mutexes and condition variables for synchronization, with performance close to Go for pooled tasks but slower for fine-grained hand-offs due to kernel wakeup costs.
- Benchmarks show So's pthread-based concurrency is competitive for uncontended locks and atomic operations, but condition variables and channels are significantly slower when threads block, with up to 23x slower unbuffered channel transfers.
- Design decisions include using pthreads instead of fibers for simplicity, keeping concurrency in the standard library for explicit allocations and flexibility, and providing timeouts instead of select for channel operations.
- The approach offers simplicity and performance close to Go for coarse-grained workloads but cannot match Go's efficiency for fine-grained concurrency due to the overhead of kernel thread management.
Show HN: Build offline-first web apps in pure Go and HTML
3 months ago
- Swag allows building offline-first web apps using Go and HTML without JavaScript.
- It compiles Go handlers and templates to WebAssembly, running them in a Service Worker for local execution after first visit.
- Dual deployment: same app serves HTTP requests natively and as WASM for offline use.
- Features include persistent storage, sync, PWA manifest, and cache versioning.
- Reference apps demonstrate real-time markdown preview and offline social feed reading.

go

Pgtestdb's template cloning approach to testing is fast

Giving your Go apps Tigris superpowers | Tigris Object Storage

How my minimal, memory-safe Go rsync steers clear of vulnerabilities

Go Analysis Framework: modular static analysis by go team

Gsxui – Shadcn-style components for Go

Stinkpot: SQLite-Backed Shell History

Escape Analysis in Go: Stack vs. Heap Allocations Explained

Building the Pkg.go.dev TUI Explorer

Go-Flavored Concurrency in C

Show HN: Build offline-first web apps in pure Go and HTML