Skip to main content
The SDK does not use cgo. A target must provide the networking, DNS, cryptographic randomness, and root-certificate facilities expected by the Go standard library.

​
Security posture

  • Transport security: TLS certificate and hostname verification are mandatory. The built-in transport supports custom trust roots, TLS 1.2 and 1.3 bounds, TLS 1.2 cipher allowlists, encrypted PKCS #8 client keys, and mutual TLS. Deprecated RFC 1423 encrypted PEM is rejected.
  • Network policy: Redirects are disabled. Ambient proxy variables are ignored; configure one explicit CONNECT proxy. Plain HTTP is limited to canonical loopback hosts.
  • Proxy authentication: Credentials are requested only after the configured proxy returns a CONNECT 407. They are never sent to the publish origin.
  • Resource limits: Request and response bodies, response headers, decompression, nested values, in-flight operations, aggregate buffered bytes, connection counts, and connection lifetimes are bounded.
  • Redaction: Errors, diagnostics, observers, telemetry, and scripted request headers exclude credentials and payload values. The SDK does not remove personal data from an event; the payload you pass is intentionally sent to Repost.
  • Callbacks: Credential, DNS, proxy, and telemetry callbacks are application code. They must respect contexts where supplied, return promptly, and remain safe for concurrent use.
  • FIPS: Version 0.3.0 is not FIPS-certified. It uses the Go runtime’s standard cryptographic and TLS implementations.

​
Native verification

The native Go suite selects and asserts all 415 required transport scenarios without a shared language validator: 329 runtime and custom-transport cases, 14 concurrency cases, 49 production HTTP cases, and 23 enterprise network cases. Inventory tests require every scenario ID exactly once and reject skips in required runners. The suite also exercises generated-client imports, the public generated method tree, the default HTTP/1.1 and HTTP/2 transports over real local sockets, proxy and TLS paths, cancellation, capacity bounds, deterministic testing helpers, response parsing, observer behavior, and runtime shutdown. Race-enabled tests and leak checks cover the root and OpenTelemetry modules.

​
Continue

Configuration

Configure proxy, TLS, mTLS, HTTP/2, DNS, and pooling.

Reliability

Understand bounded retries and ambiguous delivery.

SDKs

Compare the generated clients available from one schema.