Capslock

Questions & Answers

What is Google's Capslock tool?

Capslock is a command-line interface (CLI) tool for Go packages that performs capability analysis. It identifies which privileged operations a Go package can access by tracing transitive calls to privileged standard library functions.

Who should use Capslock for Go packages?

Capslock is intended for Go developers, security engineers, and teams concerned with supply chain security. It helps them understand the permissions and potential risks associated with their Go package dependencies.

How does Capslock differ from traditional vulnerability scanners?

Unlike tools that primarily identify known vulnerabilities (CVEs), Capslock focuses on classifying a package's capabilities, meaning the permissions it has access to. It complements vulnerability analysis by highlighting privileged code paths that may require additional scrutiny.

When is the best time to integrate Capslock into a development workflow?

Capslock should be used when evaluating new third-party dependencies, during security reviews of existing code, or to monitor for unexpected capability changes that could indicate supply chain threats. It helps ensure adherence to the Principle of Least Privilege.

How can I install and run Capslock?

You can install Capslock using go install github.com/google/capslock/cmd/capslock@latest. After installation, navigate to the path of the Go packages you wish to analyze and run the capslock command.