Grupo-Estudos-Golang on Cesar Gimenes

Overlapping text chunker for RAG pipelines

crg@crg.eti.br (Cesar Gimenes) — Sat, 06 Jun 2026 11:57:59 -0300

In a RAG (Retrieval-Augmented Generation) pipeline the first step is almost always the same: take a large text and break it into pieces before vectorizing. The pieces can’t be too big, because the model has a context limit, nor too small, because then the embedding loses semantics. And neighbors need to overlap, otherwise an answer that lands right on the boundary gets squeezed between two chunks and the retriever misses.

An encrypted vault in Go

crg@crg.eti.br (Cesar Gimenes) — Sun, 31 May 2026 01:02:01 -0300

Let’s put together the three previous pieces:

A SQLite database that lives in RAM and, on disk, exists only as an encrypted blob.

The database runs in :memory:. On exit, we take a snapshot of the database bytes, encrypt it with the password, and write it out. On startup, we read the blob, decrypt it with the password, and deserialize it back into RAM.

SQLite in RAM: serialize and deserialize in Go

crg@crg.eti.br (Cesar Gimenes) — Sun, 31 May 2026 00:46:31 -0300

SQLite can run entirely in memory, without ever touching disk. And there is a little-known trick: you can take a snapshot of the database bytes and load them back later, with no INSERT, no rebuilding anything. The functions are sqlite3_serialize and sqlite3_deserialize.

I will use the modernc.org/sqlite driver, which is pure Go, no CGo.

db, err := sql.Open("sqlite", ":memory:")
if err != nil {
 fatal(err)
}
db.SetMaxOpenConns(1)

The catch is in SetMaxOpenConns(1). A :memory: database belongs to the connection that opened it. Without limiting it to one connection, the database/sql pool could open another one, and that one would see a different, empty database.

Encryption at rest with Go's stdlib

crg@crg.eti.br (Cesar Gimenes) — Sun, 31 May 2026 00:38:32 -0300

I want to store a piece of data on disk so that, even if the file leaks, it is only readable with the password and any tampering is detected.

To do this we protect the data by encrypting it “at rest”, which basically means the data is protected while it sits on disk and can only be accessed by whoever has the right password.

You can do this with the standard library alone:

Capturing Passwords in the Terminal with Go

crg@crg.eti.br (Cesar Gimenes) — Sat, 30 May 2026 10:00:00 -0300

Reading a password in the terminal looks trivial, but it has two pitfalls: the password shows up on screen if you use ordinary input, and you need to make sure you’re really dealing with a terminal and not a redirection. Let’s solve both with the golang.org/x/term package.

If you read with bufio.Scanner or fmt.Scanln, every keystroke shows up on screen. That won’t do for a password. term.ReadPassword reads straight from the terminal, without echo:

GoScope: Exploring and Navigating Go Projects

crg@crg.eti.br (Cesar Gimenes) — Sun, 09 Feb 2025 02:47:39 -0300

I often want to quickly analyze a Go project to understand where functions, variables, and types are defined or called. That’s why I created two command-line tools: GoScope and rgs. The first scans every .go file in a project, producing a list of definitions and function calls. The second uses that list to let me navigate interactively to the exact spot in the code.

GoScope

GoScope walks through all .go files recursively starting from the current directory. It prints:

Running Remote Commands Interactively with SSH

crg@crg.eti.br (Cesar Gimenes) — Sat, 08 Feb 2025 13:38:17 -0300

I often need to run a command on a remote server without starting a full interactive session. I want the program to keep all the characteristics of a local process while running on the remote server.

At first, I just used the ssh command, specifying the server and the command to run:

ssh server command

This method doesn’t work well for programs that require a pseudo terminal, like Neovim. To fix that, I tried the -t option to force pseudo terminal allocation. With it, programs like ls display colors, but the user environment isn’t loaded. In that case, I need to pass the --color option to ls. Even so, programs like Neovim fail because the shell doesn’t behave as interactive and ANSI codes aren’t processed correctly.

Traceback in Go: How to Explore the Call Stack

crg@crg.eti.br (Cesar Gimenes) — Thu, 06 Feb 2025 02:12:46 -0300

Many programming languages provide some kind of “stack trace” or “backtrace”. Python has the traceback module, C on Linux offers the backtrace() function in execinfo.h (not part of the C standard), and Java includes Thread.dumpStack() or e.printStackTrace() for exceptions.

Stack Trace in Go

Go provides the runtime.Caller function to get information about the call stack. The following example prints the file, line, and function that called info(). Note that the argument 1 passed to runtime.Caller means we want information about the function that called info():

Data Transmission Using Sound: An Experiment with a 'Cup Telephone'

crg@crg.eti.br (Cesar Gimenes) — Sat, 25 Jan 2025 21:58:10 -0300

When I started playing with computers, the only way to load a program into the machine was to type it from scratch. My old computer had no storage; there was no hard drive, floppy disk, or any other way to store data. At startup, the machine loaded BASIC straight from ROM and that was it. Eventually I got a tape recorder, but it was terrible. With no money for a recorder made for computers, I used a household one. It took a long time adjusting the volume and other settings before I could load anything. The equipment was so finicky that I taped the controls down to keep them from moving, because the slightest change would prevent loading.

Finding Program Paths on the System with exec.LookPath in Go

crg@crg.eti.br (Cesar Gimenes) — Sat, 18 Jan 2025 22:58:48 -0300

I started a new project that needs to check whether certain programs are installed on the system and get their full paths. For that, I used the exec.LookPath function from the os/exec package.

The exec.LookPath function searches for an executable in the directories listed in the PATH environment variable. If it doesn’t find one, it returns an error. So I created the programPath function, which takes the program name and returns the executable’s path and a boolean indicating whether the program was found.

Optimizing Message Integrity Checks with FNV-1a in Go

crg@crg.eti.br (Cesar Gimenes) — Sat, 18 Jan 2025 00:43:18 -0300

In the article HMAC (Hash-based Message Authentication Code), we saw how that technique ensures a message was not altered in transit and confirms the validity of the signature.

However, while secure, that process is slow and resource-intensive. When we only need to verify message integrity without validating a signature, we can use a faster hash function. For that, we will use the FNV-1a (Fowler-Noll-Vo) algorithm, known for its speed and low collision rate.

mTLS: Implementing Mutual Authentication Between Client and Server in Go

crg@crg.eti.br (Cesar Gimenes) — Sat, 11 Jan 2025 19:49:40 -0300

mTLS (Mutual TLS) authenticates both client and server. Each one presents a digital certificate signed by a trusted certificate authority. By controlling certificate issuance, you ensure that only authorized clients access your service. It also makes it easy to identify the client without needing an API Key or Token. I also recommend using an HMAC (Hash-based Message Authentication Code) header as an additional layer of security and message integrity.

Creating Certificates

In this example, I’ll create the certificates in a simple way for local testing. When deploying to production, be careful with the parameters you use. It’s important to include Subject Alternative Names (SANs), since relying on the CN (Common Name) alone is no longer recommended.

HMAC (Hash-based Message Authentication Code) in Golang

crg@crg.eti.br (Cesar Gimenes) — Fri, 10 Jan 2025 23:33:11 -0300

When building APIs, it’s a good idea to add an authentication header to guarantee message integrity. For example, when your server sends a request or a webhook, include an X-Signature header with an HMAC (Hash-based Message Authentication Code) signature.

To generate the HMAC signature, you use a secret key and the content to be signed, such as the request body, and send the signature in the header. It’s important to make clear exactly what is being signed. I’ve run into problems with clients who couldn’t validate the signature because they used the body parsed as JSON instead of the raw body received in the request.

Safe JSON Validation and Integration in Go APIs with json.RawMessage

crg@crg.eti.br (Cesar Gimenes) — Thu, 09 Jan 2025 00:28:29 -0300

I recently built an API where the user sends a JSON value in one of the fields. The requirement was to log invalid JSON errors but let the rest of the data continue through the system’s normal flow.

It was also important that, if the received JSON was valid, it would be integrated seamlessly into the API responses. Since the JSON could vary and I didn’t know its structure, I used json.RawMessage as the field type. That way, when calling json.Marshal, the data is correctly embedded into the main JSON.

Manipulating Special Permission Bits

crg@crg.eti.br (Cesar Gimenes) — Sat, 04 Jan 2025 00:36:51 -0300

In the article on Privilege Reduction in Programs, we used the sudo command to run a program with superuser privileges. However, it’s possible to do this without an external command.

For that, we use special file permissions known as the setuid bit and the setgid bit. These attributes allow files to be executed with the privileges of the owning user or group.

To set the setuid and setgid bits, we use the chmod command with the u+s and g+s options, respectively.

Dropping Privileges in Go Programs to Improve Security

crg@crg.eti.br (Cesar Gimenes) — Thu, 02 Jan 2025 22:43:45 -0300

A good practice for improving the security of a system is to drop a program’s execution privileges. Ideally, a program should run with the fewest privileges possible.

On UNIX-like systems, you can change the user and group a program runs as. Let’s walk through how to do that in Go.

Checking Whether the Program Is Running as Root

First, check whether the program is running as root. This matters because we’ll use system calls that require root privileges. (There are other ways to grant these privileges, but we’ll cover that in another article.)

References in Comments with Golang

crg@crg.eti.br (Cesar Gimenes) — Wed, 01 Jan 2025 13:28:17 -0300

A quick tip about comments in Go: include references in them. Put the element you want to reference between brackets ([ and ]). It works with anything that can be referenced, such as variables, constants, functions, and so on.

Here is an example:

package main

import (
 "fmt"
 "time"
)

// pi representa a constante matemática Pi
const pi = 3.14159

// CalcularArea calcula a área de um círculo dado o raio.
// Utiliza a constante [pi] para o cálculo.
func CalcularArea(raio float64) float64 {
 return pi * raio * raio
}

func main() {
 raio := 5.0
 area := CalcularArea(raio)
 fmt.Printf(
 "A área do círculo com raio %.2f é %.2f\n",
 raio,
 area,
 )

 /*
 Formatos úteis:
 [time.DateTime]
 [time.Kitchen]
 [time.RFC3339Nano]
 [time.RFC3339]
 */
 fmt.Println(time.Now().Format(time.DateTime))
}

In Neovim, place the cursor between the brackets and press Ctrl-] to jump to the definition of the referenced element. To go back, press Ctrl-t. In VSCode, use the Go to Definition extension to do the same thing.

Plasma Effect in the Terminal with Golang

crg@crg.eti.br (Cesar Gimenes) — Tue, 31 Dec 2024 17:34:13 -0300

One kind of program I’ve always found interesting is the demo: eye-catching graphical effects with code that squeezes every ounce of performance out of the machine. The plasma effect is one of my favorites, simulating a fluid in motion.

To create the plasma effect, I use several trigonometric functions to calculate the background color of each character, passing time as a parameter to generate the animation. The code is relatively simple, but the optimization is a bit more complex.

Happy 2025, Fireworks in the Terminal with Golang

crg@crg.eti.br (Cesar Gimenes) — Tue, 31 Dec 2024 13:09:42 -0300

A small program celebrates the arrival of 2025 with fireworks in the terminal. It includes several interesting tricks to start your year with plenty of code.

We use os.Stdout.WriteString to write directly to the stdout descriptor, that is, the terminal’s standard output. This is the fastest way to write to the terminal, but it is not synchronized. That means there is no guarantee the output will be written in the expected order. In our case, though, this is desirable because it lets the fireworks overlap, giving the impression that they are exploding simultaneously.