---
name: "glab-dependency-firewall-go"
section: "1"
platform: "linux"
package: "glab"
version: "1.126.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/glab-dependency-firewall-go"
---

# glab-dependency-firewall-go(1)

Run go through the GitLab Dependency Firewall. (BETA)

## NAME

glab-dependency-firewall-go - Run go through the GitLab Dependency Firewall. (BETA)

## SYNOPSIS

**glab dependency-firewall go  \[flags\]**

## DESCRIPTION

Run the go binary through the GitLab Dependency Firewall. The command checks each module download against the policy for the current project, refuses blocked modules, and summarizes the results after the run.

Module downloads go through a Go module proxy that the command starts on **127.0.0.1** for the run. No certificate is involved, so your system trust store is not changed.

For the run, **GOPROXY** points at that proxy, **GONOPROXY** is **none**, and **GO111MODULE** is **on**, so every module download is checked. Private modules matched by **GOPRIVATE** are also checked, then fetched the way your configuration fetches them.

If you set **GOPROXY=off**, the command keeps it. If you set **GOPROXY** to any other non-default value, the command stops before it runs **go**.

The command checks only modules that **go** downloads during the run:

- •

  Modules already in your module cache are not checked. In CI, point **GOMODCACHE** at an empty directory to check every module.

- •

  Vendored code and **replace** directives that point at a local path are not checked.

- •

  Go toolchain downloads are not checked by policy. **go** verifies them against the checksum database.

Module paths and versions, including private ones, are sent to the policy API and written to **.gitlab/df/ci-log.json**. CI jobs that upload that file publish them with the job's artifacts.

Tests that make HTTPS requests can fail certificate checks under this command. Run **go test** outside the firewall if your tests reach the network.

All arguments are forwarded to **go** verbatim.

This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development\_stages\_support/.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## EXAMPLE

```
# Download modules through the Dependency Firewall
glab dependency-firewall go mod download
# Add a dependency, checking it against the policy first
glab dependency-firewall go get github.com/pkg/errors@v0.9.1
```

## SEE ALSO

**[glab-dependency-firewall(1)](/glab-dependency-firewall/1.md)**