diff --git a/.buildkite/steps/setup.yml b/.buildkite/steps/setup.yml
index b9b6c5cf1f..87298e4e4f 100644
--- a/.buildkite/steps/setup.yml
+++ b/.buildkite/steps/setup.yml
@@ -1,7 +1,7 @@
 - label: Prepare scion_base and scion images
   command:
       - $BASE/clean_env.sh
-      - ./tools/ci/prepare_image 1b1fef8952469b4895c9871314b0a92228426d9058132e8b5f3a8b89308f2fed
+      - ./tools/ci/prepare_image a57a514a4270294849579bbb335acc754ed969c0591a13884757fc73f3c49da1
       - ./docker.sh build
 - wait
 - label: Start container
diff --git a/.circleci/config.yml b/.circleci/config.yml
index e1a7aaf9c8..7be08ae67f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -25,7 +25,7 @@ jobs:
                 command: sudo apt-get update && sudo ./tools/install_docker
             - run:
                 name: Pull and tag scion_base image
-                command: ./tools/ci/prepare_image 1b1fef8952469b4895c9871314b0a92228426d9058132e8b5f3a8b89308f2fed
+                command: ./tools/ci/prepare_image a57a514a4270294849579bbb335acc754ed969c0591a13884757fc73f3c49da1
                 when: always
             - run:
                 name: Build scion:latest image
diff --git a/go/Makefile b/go/Makefile
index 750c775e6f..9fea721c78 100644
--- a/go/Makefile
+++ b/go/Makefile
@@ -58,6 +58,8 @@ lint: vendor/.deps.stamp
 	out=$$(find . -type f -iname '*.go' -a '!' '(' -ipath './vendor/*' -o -ipath '*/*.capnp.go' -o -ipath '*/*.gen.go' -o -ipath '*/mock_*/*' ')' | lll -w 4 -l 100 --files -e '`comment:"|`ini:"|https?:'); if [ -n "$$out" ]; then echo "$$out"; exit 1; fi
 	@echo "======> go vet"
 	go vet ${LOCAL_PKGS}
+	@echo "======> misspell"
+	misspell ${LOCAL_DIRS}
 
 deps_gen: deps proto
 
diff --git a/go/border/braccept/tpkt/overlay.go b/go/border/braccept/tpkt/overlay.go
index c3d0443bb4..2d9c882799 100644
--- a/go/border/braccept/tpkt/overlay.go
+++ b/go/border/braccept/tpkt/overlay.go
@@ -25,7 +25,7 @@ import (
 var _ LayerBuilder = (*OverlayIP4UDP)(nil)
 var _ LayerMatcher = (*OverlayIP4UDP)(nil)
 
-// OverlayIP4UDP implementes the IPv4/UDP overlay
+// OverlayIP4UDP implements the IPv4/UDP overlay
 type OverlayIP4UDP struct {
 	SrcAddr string
 	SrcPort uint16
diff --git a/go/border/io.go b/go/border/io.go
index 07b5e3bf61..03a0b07379 100644
--- a/go/border/io.go
+++ b/go/border/io.go
@@ -115,7 +115,7 @@ Top:
 			rp.DirFrom = s.Dir
 			rp.Free = free // Set free callback.
 			if i == pktsRead-1 {
-				// Only bother setting the Guage once per ReadBatch. Use
+				// Only bother setting the Gauge once per ReadBatch. Use
 				// the last read as internally the kernel calls recvmsg
 				// multiple times, so it will have the latest value.
 				inputRcvOvfl.Set(float64(meta.RcvOvfl))
diff --git a/go/border/rctx/rctx.go b/go/border/rctx/rctx.go
index 425713a1c8..93f157cfda 100644
--- a/go/border/rctx/rctx.go
+++ b/go/border/rctx/rctx.go
@@ -83,7 +83,7 @@ func (ctx *Ctx) ResolveSVCAny(svc addr.HostSVC) (*overlay.OverlayAddr, error) {
 	return elem.OverlayAddr(ctx.Conf.Topo.Overlay), nil
 }
 
-// ResolveSVCMulti resovles a multicast SVC address (i.e. one packet per machine hosting
+// ResolveSVCMulti resolves a multicast SVC address (i.e. one packet per machine hosting
 // instances for a local infrastructure service).
 func (ctx *Ctx) ResolveSVCMulti(svc addr.HostSVC) ([]*overlay.OverlayAddr, error) {
 	_, elemMap, err := ctx.GetSVCNamesMap(svc)
diff --git a/go/border/rpkt/rpkt.go b/go/border/rpkt/rpkt.go
index 2d0838f762..a0c238b7de 100644
--- a/go/border/rpkt/rpkt.go
+++ b/go/border/rpkt/rpkt.go
@@ -54,7 +54,7 @@ func Init(rawSRevF func(RawSRevCallbackArgs)) {
 }
 
 // Router representation of SCION packet, including metadata.  The comments for the members have
-// tags to specifiy if the member is set during receiving (RECV), parsing (PARSE), processing
+// tags to specify if the member is set during receiving (RECV), parsing (PARSE), processing
 // (PROCESS) or routing (ROUTE). A number of the non-exported fields are pointers, as they are
 // either optional or computed only on demand.
 type RtrPkt struct {
diff --git a/go/lib/common/errors.go b/go/lib/common/errors.go
index 046b30f3bb..169513179a 100644
--- a/go/lib/common/errors.go
+++ b/go/lib/common/errors.go
@@ -66,7 +66,7 @@ type Temporary interface {
 	Temporary() bool
 }
 
-// IsTemporaryErr determins if e is a temporary Error. As a fall-back, if e implements ErrorNester,
+// IsTemporaryErr determines if e is a temporary Error. As a fall-back, if e implements ErrorNester,
 // IsTemporaryErr recurses on the nested error. Otherwise returns false.
 func IsTemporaryErr(e error) bool {
 	if t, _ := e.(Temporary); t != nil {
@@ -84,7 +84,7 @@ type Timeout interface {
 	Timeout() bool
 }
 
-// IsTimeoutErr determins if e is a temporary Error. As a fall-back, if e implements ErrorNester,
+// IsTimeoutErr determines if e is a temporary Error. As a fall-back, if e implements ErrorNester,
 // IsTimeoutErr recurses on the nested error. Otherwise returns false.
 func IsTimeoutErr(e error) bool {
 	if t, _ := e.(Timeout); t != nil {
diff --git a/go/lib/pathpol/policy.go b/go/lib/pathpol/policy.go
index d1a218c95d..3bedde6b28 100644
--- a/go/lib/pathpol/policy.go
+++ b/go/lib/pathpol/policy.go
@@ -119,7 +119,7 @@ func (p *Policy) applyExtended(extends []string, exPolicies []*ExtPolicy) error
 }
 
 // evalOptions evaluates the options of a policy and returns the pathSet that matches the option
-// with the heighest weight
+// with the highest weight
 func (p *Policy) evalOptions(inputSet spathmeta.AppPathSet) spathmeta.AppPathSet {
 	subPolicySet := make(spathmeta.AppPathSet)
 	currWeight := p.Options[0].Weight
diff --git a/go/lib/sciond/reconn.go b/go/lib/sciond/reconn.go
index 4581c0f013..5ea755ebbd 100644
--- a/go/lib/sciond/reconn.go
+++ b/go/lib/sciond/reconn.go
@@ -37,7 +37,7 @@ var _ Connector = (*reconnector)(nil)
 // This is not necessary for request-response matching, but is useful for
 // context.Context support. If performance becomes an issue, an improvement
 // might be to have a lightweight implementation that just ensures context
-// suport.
+// support.
 type reconnector struct {
 	path string
 }
diff --git a/go/lib/sciond/sciond.go b/go/lib/sciond/sciond.go
index e826ff55ad..4fe91f8759 100644
--- a/go/lib/sciond/sciond.go
+++ b/go/lib/sciond/sciond.go
@@ -109,7 +109,7 @@ func (s *service) ConnectTimeout(timeout time.Duration) (Connector, error) {
 // an error occurs, or the method successfully returns.
 type Connector interface {
 	// Paths requests from SCIOND a set of end to end paths between src and
-	// dst. max specifices the maximum number of paths returned.
+	// dst. max specifies the maximum number of paths returned.
 	Paths(ctx context.Context, dst, src addr.IA, max uint16, f PathReqFlags) (*PathReply, error)
 	// ASInfo requests from SCIOND information about AS ia.
 	ASInfo(ctx context.Context, ia addr.IA) (*ASInfoReply, error)
diff --git a/go/lib/scrypto/cert/cert_test.go b/go/lib/scrypto/cert/cert_test.go
index cf8fd07b86..c8c0d9c966 100644
--- a/go/lib/scrypto/cert/cert_test.go
+++ b/go/lib/scrypto/cert/cert_test.go
@@ -208,7 +208,7 @@ func Test_Certificate_Eq(t *testing.T) {
 			SoMsg("Eq", c1.Eq(c2), ShouldBeFalse)
 		})
 		Convey("Certificates are unequal (EncAlgorithm)", func() {
-			c1.EncAlgorithm = "Ceasar Cipher"
+			c1.EncAlgorithm = "Caesar Cipher"
 			SoMsg("Eq", c1.Eq(c2), ShouldBeFalse)
 		})
 		Convey("Certificates are unequal (ExpirationTime)", func() {
diff --git a/go/lib/scrypto/mac.go b/go/lib/scrypto/mac.go
index 26387afa8d..617a5e86fb 100644
--- a/go/lib/scrypto/mac.go
+++ b/go/lib/scrypto/mac.go
@@ -24,8 +24,8 @@ import (
 )
 
 const (
-	ErrorCipherFailure = "Unable to initalize AES cipher"
-	ErrorMacFailure    = "Unable to initalize Mac"
+	ErrorCipherFailure = "Unable to initialize AES cipher"
+	ErrorMacFailure    = "Unable to initialize Mac"
 )
 
 func InitMac(key common.RawBytes) (hash.Hash, error) {
diff --git a/go/lib/snet/writer.go b/go/lib/snet/writer.go
index 85cfecb204..97c5c7bc9e 100644
--- a/go/lib/snet/writer.go
+++ b/go/lib/snet/writer.go
@@ -85,7 +85,7 @@ func (c *scionConnWriter) WriteTo(b []byte, raddr net.Addr) (int, error) {
 }
 
 // Write sends b through a connection with fixed remote address. If the remote
-// address for the conenction is unknown, Write returns an error.
+// address for the connection is unknown, Write returns an error.
 func (c *scionConnWriter) Write(b []byte) (int, error) {
 	return c.write(b, nil)
 }
diff --git a/go/lib/sock/reliable/reliable.go b/go/lib/sock/reliable/reliable.go
index b50fc806a9..7a087a0cd8 100644
--- a/go/lib/sock/reliable/reliable.go
+++ b/go/lib/sock/reliable/reliable.go
@@ -408,7 +408,7 @@ func (conn *Conn) WriteTo(buf []byte, dst net.Addr) (int, error) {
 			return 0, err
 		}
 		if n > 0 {
-			// FIXME(scrye): if the message was succesfully written,
+			// FIXME(scrye): if the message was successfully written,
 			// we want to return from the function. If the message
 			// could not be written, repeatedly try to write until
 			// it works. This is far from optimal, but we will rarely
diff --git a/go/lib/spath/hop.go b/go/lib/spath/hop.go
index d41ae4fb79..28fe20ee2f 100644
--- a/go/lib/spath/hop.go
+++ b/go/lib/spath/hop.go
@@ -120,7 +120,7 @@ func (h *HopField) Verify(macH hash.Hash, tsInt uint32, prev common.RawBytes) er
 	return nil
 }
 
-// CalcMac calculates the MAC of a HopField and its preceeding HopField, if any.
+// CalcMac calculates the MAC of a HopField and its preceding HopField, if any.
 // prev does not contain flags byte.
 //
 // MAC input block format:
diff --git a/go/lib/topology/addr.go b/go/lib/topology/addr.go
index e839dff01e..3663866979 100644
--- a/go/lib/topology/addr.go
+++ b/go/lib/topology/addr.go
@@ -27,7 +27,7 @@ const (
 	ErrUnsupportedOverlay   = "Unsupported overlay"
 	ErrUnsupportedAddrType  = "Unsupported address type"
 	ErrInvalidPub           = "Invalid public address"
-	ErrInvalidBind          = "Invalid bind adress"
+	ErrInvalidBind          = "Invalid bind address"
 	ErrAtLeastOnePub        = "Overlay requires at least one public address"
 	ErrOverlayPort          = "Overlay port set for non-UDP overlay"
 	ErrBindAddrEqPubAddr    = "Bind address equal to Public address"
diff --git a/go/path_srv/main.go b/go/path_srv/main.go
index 8020afed20..a7a6adb9ed 100644
--- a/go/path_srv/main.go
+++ b/go/path_srv/main.go
@@ -123,7 +123,7 @@ func realMain() int {
 		return 1
 	}
 	msger.AddHandler(infra.ChainRequest, trustStore.NewChainReqHandler(false))
-	// TOOD(lukedirtwalker): with the new CP-PKI design the PS should no longer need to handle TRC
+	// TODO(lukedirtwalker): with the new CP-PKI design the PS should no longer need to handle TRC
 	// and cert requests.
 	msger.AddHandler(infra.TRCRequest, trustStore.NewTRCReqHandler(false))
 	args := handlers.HandlerArgs{
diff --git a/go/sig/egress/worker/worker.go b/go/sig/egress/worker/worker.go
index 8527138204..e39df5ffc5 100644
--- a/go/sig/egress/worker/worker.go
+++ b/go/sig/egress/worker/worker.go
@@ -46,7 +46,7 @@ import (
 //   | Sess Id|      Epoch      |    Sequence number       |     Index       |
 //   +--------+--------+--------+--------+--------+--------+--------+--------+
 //
-//   Inside the frame, all encapsulated packets are preceeded by a 2B length
+//   Inside the frame, all encapsulated packets are preceded by a 2B length
 //   field, and then padded to an 8B boundary
 
 const (
diff --git a/go/tools/topopruner/topopruner.go b/go/tools/topopruner/topopruner.go
index 7516cb114f..cf68f44f0e 100644
--- a/go/tools/topopruner/topopruner.go
+++ b/go/tools/topopruner/topopruner.go
@@ -12,9 +12,9 @@ import (
 
 var (
 	infn   = flag.String("in", "", "Input file name. Required.")
-	outfnf = flag.String("out", "", "Ouput file name for the full topology. Required.")
+	outfnf = flag.String("out", "", "Output file name for the full topology. Required.")
 	outfnr = flag.String("reduced", "",
-		"Ouput file name for the reduced topology. Defaults to not generating this output.")
+		"Output file name for the reduced topology. Defaults to not generating this output.")
 	verbose = flag.Bool("verbose", false, "Be more verbose about what is going on")
 )
 
diff --git a/go/vendor/vendor.json b/go/vendor/vendor.json
index 2df3454df3..d4f26ca948 100644
--- a/go/vendor/vendor.json
+++ b/go/vendor/vendor.json
@@ -91,6 +91,18 @@
 			"revision": "9127e812e1e9e501ce899a18121d316ecb52e4ba",
 			"revisionTime": "2017-03-28T20:00:08Z"
 		},
+		{
+			"checksumSHA1": "rYc2bTNfDk0JL5Tb+B/snlzRkJE=",
+			"path": "github.com/client9/misspell",
+			"revision": "c0b55c8239520f6b5aa15a0207ca8b28027ba49e",
+			"revisionTime": "2018-03-09T02:03:25Z"
+		},
+		{
+			"checksumSHA1": "3Lbx+qNi8brwKa9dU41O6SEOW6c=",
+			"path": "github.com/client9/misspell/cmd/misspell",
+			"revision": "c0b55c8239520f6b5aa15a0207ca8b28027ba49e",
+			"revisionTime": "2018-03-09T02:03:25Z"
+		},
 		{
 			"checksumSHA1": "s8t6UaijV8WMK0RMdX00OPI5z0o=",
 			"path": "github.com/dchest/cmac",