External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add audit system with sink based dispatcher (#211)

Browse Source 
* chore: Dependency update

* feat: Add audit system with eventlog as a sink

* fix: Linter fixes

* fix: Code review fixes
This commit is contained in:
Abhisek Datta
2026-04-10 19:07:15 +05:30
committed by GitHub
parent e72ff6aeaf
commit 0355a5d4fd
19 changed files with 872 additions and 284 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/interceptors/audit_logger.go
+2 -2
View File
@@ -1,7 +1,7 @@
package interceptors
import (
"github.com/safedep/pmg/internal/eventlog"
"github.com/safedep/pmg/internal/audit"
"github.com/safedep/pmg/proxy"
)
@@ -39,7 +39,7 @@ func (i *AuditLoggerInterceptor) HandleRequest(ctx *proxy.RequestContext) (*prox
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
}
eventlog.LogProxyHostObserved(ctx.Hostname, ctx.Method, "audit_logger_interceptor", map[string]interface{}{
audit.LogProxyHostObserved(ctx.Hostname, ctx.Method, "audit_logger_interceptor", map[string]interface{}{
"request_id": ctx.RequestID,
})
proxy/interceptors/base_registry.go
+9 -15
View File
@@ -10,7 +10,7 @@ import (
"github.com/safedep/dry/log"
"github.com/safedep/pmg/analyzer"
"github.com/safedep/pmg/config"
"github.com/safedep/pmg/internal/eventlog"
"github.com/safedep/pmg/internal/audit"
"github.com/safedep/pmg/proxy"
gobreaker "github.com/sony/gobreaker/v2"
"google.golang.org/grpc/codes"
@@ -82,7 +82,7 @@ func (b *baseRegistryInterceptor) analyzePackage(
if cfg := config.Get(); cfg.InsecureInstallation {
log.Debugf("[%s] Skipping insecure installation", ctx.RequestID)
eventlog.LogInstallInsecureBypass(packageName, packageVersion, ecosystem.String())
audit.LogInstallInsecureBypass(pkgVersion)
return &analyzer.PackageVersionAnalysisResult{
PackageVersion: pkgVersion,
@@ -94,7 +94,7 @@ func (b *baseRegistryInterceptor) analyzePackage(
log.Debugf("[%s] Skipping trusted package: %s/%s@%s",
ctx.RequestID, ecosystem.String(), packageName, packageVersion)
eventlog.LogInstallTrustedAllowed(packageName, packageVersion, ecosystem.String())
audit.LogInstallTrustedAllowed(pkgVersion)
return &analyzer.PackageVersionAnalysisResult{
PackageVersion: pkgVersion,
@@ -153,10 +153,7 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
case analyzer.ActionBlock:
log.Warnf("[%s] Blocking malicious package %s@%s", ctx.RequestID, packageName, packageVersion)
eventlog.LogMalwareBlocked(packageName, packageVersion, ecosystem.String(), result.Summary, map[string]interface{}{
"analysis_id": result.AnalysisID,
"reference_url": result.ReferenceURL,
})
audit.LogMalwareBlocked(result.PackageVersion, result.Summary, result.AnalysisID, result.ReferenceURL, result.IsMalware, result.IsVerified)
if b.statsCollector != nil {
b.statsCollector.RecordBlocked(result)
@@ -195,10 +192,7 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
if !confirmed {
log.Infof("[%s] User declined installation of suspicious package %s/%s@%s", ctx.RequestID, ecosystem.String(), packageName, packageVersion)
eventlog.LogMalwareBlocked(packageName, packageVersion, ecosystem.String(), result.Summary, map[string]interface{}{
"analysis_id": result.AnalysisID,
"reference_url": result.ReferenceURL,
})
audit.LogMalwareBlocked(result.PackageVersion, result.Summary, result.AnalysisID, result.ReferenceURL, result.IsMalware, result.IsVerified)
if b.statsCollector != nil {
b.statsCollector.RecordUserCancelled(result)
@@ -217,8 +211,8 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
}, nil
}
eventlog.LogMalwareConfirmed(packageName, packageVersion, ecosystem.String())
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
audit.LogMalwareConfirmed(result.PackageVersion)
audit.LogInstallAllowed(result.PackageVersion, 1)
if b.statsCollector != nil {
b.statsCollector.RecordConfirmed(result)
@@ -228,7 +222,7 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
case analyzer.ActionAllow:
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
audit.LogInstallAllowed(result.PackageVersion, 1)
if b.statsCollector != nil {
b.statsCollector.RecordAllowed(result)
@@ -238,7 +232,7 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
default:
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
audit.LogInstallAllowed(result.PackageVersion, 1)
if b.statsCollector != nil {
b.statsCollector.RecordAllowed(result)