mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
50 lines
2.3 KiB
Go
50 lines
2.3 KiB
Go
|
package packagemanager
|
||
|
|
|
||
|
|
import "fmt"
|
||
|
|
|
||
|
|
// proxyNoProxyList is the NO_PROXY value for proxied package-manager runs.
|
||
|
|
//
|
||
|
|
// The IPv6 loopback uses the bare ::1: the bracketed [::1] is URL syntax that
|
||
|
|
// crashes Python's urllib/httpx (#339). Trade-off: Node's NODE_USE_ENV_PROXY
|
||
|
|
// (undici) only bypasses the bracketed form, so a literal http://[::1] from
|
||
|
|
// Node still gets proxied. localhost/127.0.0.1 cover the common cases; the
|
||
|
|
// IPv6 literal is a rare edge we accept since NO_PROXY can't be set per-client.
|
||
|
|
const proxyNoProxyList = "localhost,127.0.0.1,::1"
|
||
|
|
|
||
|
|
// EnvVarForProxy returns the environment variables (KEY=VALUE lines) that route
|
||
|
|
// the supported package managers through the proxy at proxyAddr and make them
|
||
|
|
// trust its MITM CA at certPath. It encodes per-package-manager quirks: yarn
|
||
|
|
// Berry ignores HTTP_PROXY and needs YARN_* (#319); pip/requests and Node each
|
||
|
|
// read their own CA-bundle var.
|
||
|
|
//
|
||
|
|
// The cert-path variables are always emitted, never skipped based on OS
|
||
|
|
// trust-store status. Whether a tool trusts the OS store varies by tool,
|
||
|
|
// version and config: modern pip (>=24.2) and recent Node (--use-system-ca) can
|
||
|
|
// read it, but older versions, requests/certifi, and default configs still rely
|
||
|
|
// on bundled CA lists. Emitting these vars is the conservative choice that works
|
||
|
|
// across that matrix, and is harmless for tools that do read the OS store (they
|
||
|
|
// ignore the vars). Skipping them when a system CA exists would silently break
|
||
|
|
// any tool still on a bundled store.
|
||
|
|
func EnvVarForProxy(proxyAddr, certPath string) []string {
|
||
|
|
proxyURL := fmt.Sprintf("http://%s", proxyAddr)
|
||
|
|
|
||
|
|
return []string{
|
||
|
|
"PIP_RETRIES=0",
|
||
|
|
"NODE_USE_ENV_PROXY=1",
|
||
|
|
fmt.Sprintf("HTTP_PROXY=%s", proxyURL),
|
||
|
|
fmt.Sprintf("HTTPS_PROXY=%s", proxyURL),
|
||
|
|
fmt.Sprintf("http_proxy=%s", proxyURL),
|
||
|
|
fmt.Sprintf("https_proxy=%s", proxyURL),
|
||
|
|
fmt.Sprintf("NO_PROXY=%s", proxyNoProxyList),
|
||
|
|
fmt.Sprintf("no_proxy=%s", proxyNoProxyList),
|
||
|
|
fmt.Sprintf("PIP_PROXY=%s", proxyURL),
|
||
|
|
fmt.Sprintf("YARN_HTTP_PROXY=%s", proxyURL),
|
||
|
|
fmt.Sprintf("YARN_HTTPS_PROXY=%s", proxyURL),
|
||
|
|
fmt.Sprintf("NODE_EXTRA_CA_CERTS=%s", certPath),
|
||
|
|
fmt.Sprintf("SSL_CERT_FILE=%s", certPath),
|
||
|
|
fmt.Sprintf("REQUESTS_CA_BUNDLE=%s", certPath),
|
||
|
|
fmt.Sprintf("PIP_CERT=%s", certPath),
|
||
|
|
fmt.Sprintf("YARN_HTTPS_CA_FILE_PATH=%s", certPath),
|
||
|
|
}
|
||
|
|
}
|