Forks, ports, packagings and Go replacements of open-source libraries and tools, for performance and correctness.

Each fork stands in for the project it comes from, with bugs fixed, hot paths made faster and hostile input contained; what differs from upstream is listed change by change, and upstream keeps its credit and its licence. Beside the forks, upstream programs built for the platforms their official builds miss, and a few tools of our own.

Forks

Upstream's code with fixes and features of ours. Each repository's UPSTREAM.md says where it forked, what it has taken from upstream since, and what it has that upstream does not, change by change.

blake3: A fork of lukechampine/blake3, the BLAKE3 hash in Go with AVX2 and AVX-512 routines and the bao verified-streaming encoding; the fork corrects XOF seeking and bao bounds, and validates key and size instead of panicking.
erofs: A fork of erofs/go-erofs: EROFS filesystem images read and created through the standard fs.FS interface, in pure Go; hardened against untrusted images, corrected on several on-disk paths, and faster to read.
git-validation: A fork of vbatts/git-validation, which checks a range of commits for a DCO sign-off, a subject under 90 characters and no trailing whitespace; here it is released as binaries, with its dependencies trimmed and its checks unchanged, and long flags take two dashes (--run, --range).
go-graphviz: A fork of goccy/go-graphviz: Go bindings for Graphviz, with Graphviz compiled to WebAssembly and run on wazero, no C toolchain and no system Graphviz; the fork builds the WebAssembly reproducibly from sources fixed by digest, and types the bridge's errors.
go-licenses: A fork of google/go-licenses, which reports and checks the licences of a Go package's dependency tree; the fork removes the report and csv commands and the vendored pkgsite behind them, so the tool makes no HTTP request, and is released as binaries.
grid-clock-screensaver: A fork of chrstphrknwtn/grid-clock-screensaver: a word clock screensaver for macOS, a 16 × 15 grid of letters whose lit ones read out the time, ported to modern macOS; macOS 14 or later, Apple silicon.
xz: A fork of ulikunitz/xz: xz streams read and written in pure Go; the fork decodes faster, reads the blocks of a multi-block archive in parallel, and bounds what an archive built to break a decoder can make it do.
yamlfmt: A fork of google/yamlfmt: a YAML formatter, command line and library, with LF line endings by default, path-aware excludes and preserved comment columns.

Packagings

Upstream programs, unchanged: built or imported from upstream's own sources at a reviewed commit, for the platforms where no official build fits.

curl: curl with dependable TLS 1.3 for every platform, from curl-for-win, the curl project's own reproducible-build system: the Windows packages imported and sigstore-verified, Linux and macOS built by curl-for-win's scripts at the same commit.
openssh: OpenSSH for macOS with security keys built in, which Apple's build lacks: the client set, the agent as a user LaunchAgent, and a server off by default and user-scoped when on, built against LibreSSL's libcrypto with libfido2 linked statically, as one relocatable package.

Own projects

Our own code, under our own licence: tools written where nothing existing did the job, or none came as one versioned binary you can install and verify.

compress: Compression and archiving in pure Go: a streaming library for zstd, gzip, xz, lz4 and bzip2, and the tar, xz, gzip, zstd, zip and unzip commands built on it, released as binaries for Linux, macOS and Windows.
dot: A Graphviz dot command as one static Go binary, on go-graphviz's WebAssembly engine: no Graphviz installation, no C toolchain, no system packages.
godolint: A port of hadolint to Go: the same rules, codes, severities and messages, as a library and a command-line tool. source
hermetic: The aqua tool manager as one self-contained binary, with an install root, a project directory and a bin of its own, so the tool versions a project fixes never depend on whatever aqua the shell has.
taciturn: An ssh-agent for keys in the Mac's Secure Enclave, with a per-key policy and an audit log, for unattended sessions. source
xos: The standard library's os with FILE_SHARE_DELETE on Windows: files another process can rename or delete while this one holds them, and a rename that replaces a file readers hold open; call for call the same otherwise.