Last year, I thought we still had time to design PQ auth systems. Now, based on the pace of progress and on statements like Google's, I believe 1. we need to finish rolling out PQ kex yesterday 2. we need to start rolling out PQ auth now 3. it's too late to ship any new non-PQ design or system

We ported TamaGo to the Microchip LAN969x SoC. A collaboration with Novarq to support the Tactical 1000 network switch. Having bare metal Go on a network switch is an exciting context which opens up many development opportunities! Check their blog post: novarq.com/blogs/insigh...

I want to go back in a world where documentation is like this.

I am happy to announce that I'll be speaking at @gopherconeu.bsky.social this June. I will showcase the latest TamaGo developments and its security benefits from embedded to cloud! www.gophercon.eu#/speakers

This is an absolutely beautiful, glorious description of the products in our lives. The things that once were simple tools that met needs, now demand relationships, have opinions, and occupy cycles of our lives. Do yourself a favor, scroll down and read this page www.terrygodier.com/the-last-qui...

TamaGo was created to prove that layers often assumed far away can coexist seamlessly. The kanzashi project runs Claude/Gemini SDKs on bare metal and performs, without any OS interference, agentic investigation of the architectural attack surface. github.com/abarisani/ka...

TamaGo is now ported to aifoundry.org Erbium processor! The erbium_emu demo is live at: github.com/usbarmory/ko... I so look forward to expand support for this platform with a meaningful workload API, taking advantage of bare metal Go!

I called this project kanzashi and I will publish it next week, stay tuned.

I hacked TamaGo exception handler to report invalid register Read/Writes without crashing the VM. I used this to extend bare metal Go LLM-fuzzing all x86_64 I/O controllers. 60 seconds. "Let me try writing to redirection entries with malicious values". Hypervisor coredumps.

I just published kotama, an experimental GOOS=tamago compiler branch that allows execution of a rich example in barely 6MB of RAM, running on an rv64imfc CPU (yes, no d or a extension). This paves the way for supporting aifoundry.org Minion cores! github.com/usbarmory/ko...

A very effective way to find all deviations from specs. It is literally a semantic bridge between the VirtIO specifications and low level implementation. And I can instantly target any other low level specification, even the CPU ISA itself with more creative wiring.

Next up: UEFI (as I can simply import this in go-boot).

It was trivial to hook Claude in a bare metal environment using TamaGo. I wired it up to arbitrary memory read/writes for Virtio MMIO space exploration and it is now trying to escape my QEMU. All of this in ~200 LOC of crappy code (because Antrophic Go SDK...)

Thanks to @filippo.abyssdomain.expert contribution installing our GOOS=tamago compiler is now as easy as: go tool tamago github.com/usbarmory/ta...

PSA: PayPal U2F security key handling ignores incremental counters (unlike GitHub or saner backends)

A bare metal Go unikernel reference for AMD SEV-SNP execution. Starts under UEFI boot services with UEFI networking or can terminate them and connect through VirtIO networking (or soon gVNIC). github.com/usbarmory/tamago-sev-example

Our TamaGo framework is now aligned with the fresh Go 1.26.0 release! This major version brings new handling of GOOS with a GOOSPKG overlay, providing clearer isolation of the runtime API for freestanding Go, in-line with our upstreaming proposal. github.com/golang/go/is...

Content neutral / Structure rebel 🤣 From: benjojo.co.uk/u/benjojo/h/...

I published tamago and tamago-go 1.25.7! This release improves AMD SEV-SNP and ARM64 support and tracks Go 1.25.7 changes. github.com/usbarmory/ta...

Here's a first TamaGo unikernel under AMD SEV-SNP with VirtIO networking PCI driver working with shared guest/host buffers. Pure Go bare metal Confidential VMs with an option of UEFI, VirtIO or gVNIC networking.

Added AMD SEV-SNP key derivation, page state changes and C-bit enable/disable in our tamago sev package API. It is now trivial to allocate shared unencrypted DMA for driver implementation using Go heap space. Manipulating intimate AMD SEV-SNP inners has never been easier!

This is a perfect piece of technical writing. alexharri.com/blog/ascii-r...

I am excited to announce that we are partnering with AI Foundry to bring bare metal Go to their ET platform! Our journey started with a lonely core and now we have the chance of hitting 1088 on the ET-SoC-1! What a privilege. I look forward to this! aifoundry.org

I also released go-boot v1.4 to support pure Go unikernels under AMD SEV-SNP. UEFI is required at boot to access SNP Secrets page, then you can either remain in the same unikernel (exiting EFI Boot Services) or jump to another TamaGo unikernel ;) github.com/usbarmory/go...

And following Go 1.25.6 release, TamaGo package and compilers 1.25.6 are released as well. This release brings pure Go unikernels to Google Compute Engine and AMD SEV-SNP support (both in GCP and local QEMU)! Following this TARGET=gcp is now added to: github.com/usbarmory/ta...

TamaGo AMD SEV-SNP support is now tested on physical servers. This is a networked pure Go UEFI unikernel, launched under QEMU with AMD SEV-SNP, obtaining an attestation report and performing its online verification. Transparent, reproducible, pure Go Confidential VMs!

A year full of ❤️

And with the full Go ecosystem at this level this also becomes an unbeatable AMD SEV-SNP auditing/fuzzing environment.

TamaGo unikernels can now run in confidential AMD SEV-SNP VMs! Here's a UEFI bare metal Go unikernel performing a successful attestation request! Our next releases will include drivers and documentation for AMD SEV-SNP support.

I just released go-boot v1.3, it brings EFI variable display and pagination support. github.com/usbarmory/go...

GopherCon 2025: Graphical Apps without an OS - Andy Williams Recording is now live and it features TamaGo! youtu.be/usUz3XyiR3I?...

I'm running a TamaGo VM on Google Compute Engine. No CVEs to worry about other than Go ones, just own code and runtime, starts and reboots instantly. Open with no-auth SSH. As a cybersecurity professional this would be unthinkable, but TamaGo brings tattack surface close to 0.

GopherCon 2025: An Operating System in Go - Patricio Whittingslow Recording is now live and it features TamaGo! youtu.be/SvsdVe1kgSU?...

Oh wow, someone made an AUR for go-boot 🤩 aur.archlinux.org/packages/go-...

TamaGo support for Google Cloud Compute is maturing, networking is now sorted!

Following Go 1.25.5, tamago-go and tamago 1.25.5 are released! This release brings in ARM64 and NXP i.MX8MP support, extending our official support to a brand new architecture. More tamago/arm64 targets are being developed! github.com/usbarmory/ta... github.com/usbarmory/ta...

I am so glad I managed to acquire one of these!

The moment when you squash that bug which you felt you had years ago, but never reappeared, which definitely came back biting hard years later…

TamaGo on arm64 is progressing fast, we now have interrupt handling. I also got a hold on the new @arduino UNO Q. Would you like to see TamaGo running on it?

U.S. Graphics Company • Berkeley Mono Letterpress • Fedrigoni Matrica Gesso 360 • Black U 8 x 4.5 mm

Our talk at this year Transparency.dev summit is now live! Implementing transparency in UEFI boot managers www.youtube.com/watch?v=Srv2... Check out the project: github.com/usbarmory/bo...