Proof of work · 03
Why Go, specifically.
Because a language that compiles to a single static binary, schedules a hundred thousand concurrent conversations on a 4 GB box, and makes ignoring an error a visible act of vandalism is the only honest choice for the two constraints above. Here is what that discipline looks like in the actual code.
internal/vault/seal.go
No silent failures
package vault
import (
"context"
"crypto/aes"
"crypto/cipher"
crand "crypto/rand"
"encoding/binary"
"errors"
"fmt"
"io"
"time"
"go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/codes"
"go.opentelemetry.io/otel/trace"
)
// A version byte prefix lets keys or algorithms rotate later with no data migration.
const (
envelopeV1 = 0x01
nonceSize = 12 // 96-bit GCM nonce
)
// Sentinel errors — internal KMS/network detail never leaks to the caller.
var (
ErrSeal = errors.New("vault: seal failed")
ErrContext = errors.New("vault: context invalid or canceled")
ErrEntropy = errors.New("vault: entropy source failure")
)
// Seal encrypts one PII field with a per-record data key from KMS and returns a
// self-describing envelope. The plaintext data key never outlives this call.
func (v *Vault) Seal(ctx context.Context, plaintext []byte) (_ []byte, err error) {
if len(plaintext) == 0 {
return nil, fmt.Errorf("%w: empty payload", ErrSeal)
}
// One span per seal; success/error recorded on the way out.
ctx, span := v.tracer.Start(ctx, "Vault.Seal", trace.WithAttributes(
attribute.String("kms.key_id", v.keyID),
attribute.Int("payload.bytes", len(plaintext)),
))
defer func() {
if err != nil {
span.RecordError(err)
span.SetStatus(codes.Error, err.Error())
v.metrics.SealErrors.Inc()
}
span.End()
}()
// Bound the call only if the caller gave us no deadline of its own.
if _, ok := ctx.Deadline(); !ok && v.kmsTimeout > 0 {
var cancel context.CancelFunc
ctx, cancel = context.WithTimeout(ctx, v.kmsTimeout)
defer cancel()
}
if err = ctx.Err(); err != nil {
return nil, fmt.Errorf("%w: %w", ErrContext, err)
}
// KMS data key, with latency recorded for the SLO.
start := time.Now()
dek, err := v.kms.GenerateDataKey(ctx, v.keyID)
v.metrics.KMSLatency.Observe(time.Since(start).Seconds())
if err != nil {
return nil, fmt.Errorf("%w: generate data key", ErrSeal)
}
defer wipe(dek.Plaintext) // zeroed on every path, including panic
block, err := aes.NewCipher(dek.Plaintext)
if err != nil {
return nil, fmt.Errorf("%w: new cipher", ErrSeal)
}
gcm, err := cipher.NewGCM(block)
if err != nil {
return nil, fmt.Errorf("%w: new gcm", ErrSeal)
}
// One allocation for the whole envelope.
size := 1 + 2 + len(v.keyID) + 2 + len(dek.Ciphertext) + nonceSize + len(plaintext) + gcm.Overhead()
out := make([]byte, 0, size)
out = append(out, envelopeV1)
out = binary.BigEndian.AppendUint16(out, uint16(len(v.keyID)))
out = append(out, v.keyID...)
out = binary.BigEndian.AppendUint16(out, uint16(len(dek.Ciphertext)))
out = append(out, dek.Ciphertext...)
// Reserve the nonce and fill it from the OS CSPRNG.
ivStart := len(out)
out = out[:ivStart+nonceSize]
if _, err = io.ReadFull(crand.Reader, out[ivStart:]); err != nil {
return nil, fmt.Errorf("%w: %w", ErrEntropy, err)
}
// Seal in place: ciphertext+tag land in the same backing array.
out = gcm.Seal(out, out[ivStart:], plaintext, nil)
return out, nil
}
1 binary
No runtime to install, patch or exploit
A static Go binary in a distroless, non-root container. Nothing interpreted, no dependency tree at runtime, and a cold start measured in milliseconds. It is why one modest instance carries the whole platform.
~4 KB
Concurrency priced in kilobytes, not megabytes
A goroutine starts at a couple of kilobytes of stack. Thread-per-request runtimes start at a megabyte. That ratio is precisely why real-time audio streams and background sync workers coexist on hardware that costs single digits per month.
0 hidden
Errors you cannot ignore by accident
Go makes every failure an explicit value. Combined with errcheck as a merge gate, an unhandled error stops the pipeline. That is not ceremony — it is why production incidents arrive with a readable cause instead of a stack trace.
