External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Proxy flow should respect trusted packages (#96)

Browse Source 
* fix: Handle trusted packages in proxy flow

* perf: Pre-parse trusted PURLs

* fix: Code review fixes

* fix: Remove unused config
This commit is contained in:
Abhisek Datta
2026-01-08 00:15:02 +05:30
committed by GitHub
parent 028e78aed8
commit 1c319eba0e
7 changed files with 373 additions and 304 deletions
Download Patch File Download Diff File Expand all files Collapse all files
guard/guard_test.go
-259
View File
@@ -6,7 +6,6 @@ import (
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
"github.com/safedep/pmg/analyzer"
"github.com/safedep/pmg/config"
"github.com/safedep/pmg/internal/ui"
"github.com/safedep/pmg/packagemanager"
"github.com/stretchr/testify/assert"
@@ -270,261 +269,3 @@ func TestGuardInsecureInstallation(t *testing.T) {
})
}
func TestGuardIsTrustedPackageVersion(t *testing.T) {
tests := []struct {
name string
trustedPackages []config.TrustedPackage
pkgVersion *packagev1.PackageVersion
want bool
}{
{
name: "nil package version returns false",
trustedPackages: []config.TrustedPackage{},
pkgVersion: nil,
want: false,
},
{
name: "empty trusted packages list returns false",
trustedPackages: []config.TrustedPackage{},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: false,
},
{
name: "exact match with version returns true",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/express@4.18.0",
Reason: "trusted by team",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: true,
},
{
name: "match without version in trusted package returns true",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/express",
Reason: "all versions trusted",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: true,
},
{
name: "version mismatch returns false",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/express@4.17.0",
Reason: "old version trusted",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: false,
},
{
name: "name mismatch returns false",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/react@18.0.0",
Reason: "trusted package",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: false,
},
{
name: "ecosystem mismatch returns false",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:pypi/requests@2.28.0",
Reason: "trusted package",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "requests",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "2.28.0",
},
want: false,
},
{
name: "pypi package exact match returns true",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:pypi/requests@2.28.0",
Reason: "trusted http library",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "requests",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_PYPI,
},
Version: "2.28.0",
},
want: true,
},
{
name: "multiple trusted packages finds correct match",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/lodash@4.17.21",
Reason: "utility library",
},
{
Purl: "pkg:npm/express@4.18.0",
Reason: "web framework",
},
{
Purl: "pkg:pypi/requests@2.28.0",
Reason: "http library",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: true,
},
{
name: "multiple trusted packages no match returns false",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/lodash@4.17.21",
Reason: "utility library",
},
{
Purl: "pkg:npm/react@18.0.0",
Reason: "ui library",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: false,
},
{
name: "invalid purl in trusted packages skips and returns false",
trustedPackages: []config.TrustedPackage{
{
Purl: "invalid-purl-format",
Reason: "malformed",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: false,
},
{
name: "invalid purl skipped but valid match found",
trustedPackages: []config.TrustedPackage{
{
Purl: "invalid-purl-format",
Reason: "malformed",
},
{
Purl: "pkg:npm/express@4.18.0",
Reason: "valid trusted package",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "4.18.0",
},
want: true,
},
{
name: "package version without version field matches versionless trusted package",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/express",
Reason: "all versions trusted",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "",
},
want: true,
},
{
name: "package version without version field does not match versioned trusted package",
trustedPackages: []config.TrustedPackage{
{
Purl: "pkg:npm/express@4.18.0",
Reason: "specific version trusted",
},
},
pkgVersion: &packagev1.PackageVersion{
Package: &packagev1.Package{
Name: "express",
Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM,
},
Version: "",
},
want: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
config := PackageManagerGuardConfig{
TrustedPackages: tt.trustedPackages,
}
got := config.IsTrustedPackageVersion(tt.pkgVersion)
assert.Equal(t, tt.want, got)
})
}
}