Description
What version of Go are you using (go version)?
$ go version go version go1.16.4 windows/amd64
Does this issue reproduce with the latest release?
What operating system and processor architecture are you using (go env)?
go env Output
$ go envset GO111MODULE=on
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\sss\AppData\Local\go-build
set GOENV=C:\Users\sss\AppData\Roaming\go\env
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\sss\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=*
set GOOS=windows
set GOPATH=C:\Users\sss\go
set GOPRIVATE=
set GOPROXY=
set GOROOT=C:\Go
set GOSUMDB=off
set GOTMPDIR=
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.16.4
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=NUL
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\sss\AppData\Local\Temp\go-build91218420=/tmp/go-build -gno-record-gcc-switches
What did you do?
Run the command
strings <go_binary> | sed -n '/-----BEGIN/,/-----END/p'
If a program is using net/http library (package internal), it will contain a private key and certificate.
This is perceived as a security issue in the binary.
The key/certificate is coming from https://github.com/golang/go/blob/master/src/net/http/internal/testcert.go
So, In my code, httptest.Server.StartTLS is not called. Why is the private key linked to the binary?
What did you expect to see?
No test cert and private key in the binary.
What did you see instead?
Private key and cert in binary.