External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: advisory message appended to block output (#362)

Browse Source 
* docs(specs): add custom block messages and package blocklist spec

* docs(specs): add custom block messages and package blocklist implementation plan

* feat(config): add blocked_packages list and custom block messages

* feat(audit): add package_blocklist_blocked event and blocklist model

* feat(proxy): block blocklisted packages in the policy gate before analysis

* feat(guard): block blocklisted packages before trust skip and analysis

* feat(ui): render blocklist blocks and custom messages, fix silent-mode block output

* feat(proxy): append custom messages to malware and go-cooldown block bodies

* test(proxye2e): cover blocklist enforcement and custom block messages

* docs(specs): remove spec and plan documents

* refactor: drop guard-flow blocklist enforcement and trim docs

Guard mode is being deprecated; the blocklist is enforced in proxy mode
only. Remove the trusted_packages mirroring references outside the docs.

* refactor(config): consolidate blocklist and block message under top-level block section

Replace dependency_cooldown.message, malware.message and blocked_packages
with a single block section: block.message is appended to every block
output regardless of which control blocked, and block.packages is the
package blocklist.

* fix(ui): render block.message as info note with clean spacing

* fix(ui): indent wrapped continuation lines in block reasons and messages

* update config template

* refactor(config): replace block section with top-level advisory_message

Remove the package blocklist (will be implemented as part of policies in
the future) and replace block.message with an optional top-level
advisory_message appended to every block output.

* chore(config): move advisory_message near top-level scalar configs in template
This commit is contained in:
Sahil Bansal
2026-07-09 17:49:00 +05:30
committed by GitHub
parent c601e17cdc
commit 2d938ea381
17 changed files with 378 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/trusted.go
+17 -60
View File
@@ -2,8 +2,6 @@ package config
import (
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
"github.com/safedep/dry/api/pb"
"github.com/safedep/dry/log"
)
// IsTrustedPackage checks if a package version is trusted based on global configuration.
@@ -84,42 +82,24 @@ func cooldownSkip(skip []TrustedPackage, ecosystem packagev1.Ecosystem, name str
return info
}
// PreprocessTrustedPackages pre-parses all PURL strings in the trusted package
// lists. Exported for use in cross-package tests that install synthetic configs
// without going through Load.
func PreprocessTrustedPackages(cfg *Config) error {
return preprocessTrustedPackages(cfg)
// PreprocessPackageRefs pre-parses all PURL strings in the trusted and
// cooldown skip package lists. Exported for use in cross-package tests that
// install synthetic configs without going through Load.
func PreprocessPackageRefs(cfg *Config) error {
return preprocessPackageRefs(cfg)
}
// preprocessTrustedPackages pre-parses all PURL strings in the trusted package
// lists (both the top-level guardrail list and the cooldown-exemption list).
// This is called once during config load to avoid repeated parsing during
// trusted package checks. Invalid PURLs are logged but not fatal.
func preprocessTrustedPackages(cfg *Config) error {
preprocessTrustedPackageList(cfg.TrustedPackages)
preprocessTrustedPackageList(cfg.DependencyCooldown.Skip)
return nil
}
// preprocessTrustedPackageList parses the PURL of each entry in place, populating
// the pre-parsed ecosystem/name/version fields. Entries with an invalid PURL are
// marked unparsed (and skipped at match time) rather than failing the load.
func preprocessTrustedPackageList(packages []TrustedPackage) {
for i := range packages {
tp := &packages[i]
parsedPurl, err := pb.NewPurlPackageVersion(tp.Purl)
if err != nil {
log.Warnf("Failed to parse trusted package PURL: %s: %v", tp.Purl, err)
tp.parsed = false
continue
}
tp.parsed = true
tp.ecosystem = parsedPurl.Ecosystem()
tp.name = parsedPurl.Name()
tp.version = parsedPurl.Version()
// preprocessPackageRefs parses the PURL of each list entry in place, populating
// the pre-parsed purlRef. This is called once during config load to avoid
// repeated parsing at match time. Invalid PURLs are logged but not fatal.
func preprocessPackageRefs(cfg *Config) error {
for i := range cfg.TrustedPackages {
cfg.TrustedPackages[i].parseFrom(cfg.TrustedPackages[i].Purl)
}
for i := range cfg.DependencyCooldown.Skip {
cfg.DependencyCooldown.Skip[i].parseFrom(cfg.DependencyCooldown.Skip[i].Purl)
}
return nil
}
// isTrustedPackageVersion checks if a package version is in the trusted packages list.
@@ -128,33 +108,10 @@ func preprocessTrustedPackageList(packages []TrustedPackage) {
// If the trusted package PURL doesn't specify a version, all versions of that package are trusted.
// Returns false if pkgVersion is nil or if trustedPackages is empty.
func isTrustedPackageVersion(trustedPackages []TrustedPackage, pkgVersion *packagev1.PackageVersion) bool {
if pkgVersion == nil {
return false
}
if len(trustedPackages) == 0 {
return false
}
for _, v := range trustedPackages {
if !v.parsed {
continue
if v.matches(pkgVersion) {
return true
}
if v.ecosystem != pkgVersion.GetPackage().GetEcosystem() {
continue
}
if v.name != pkgVersion.GetPackage().GetName() {
continue
}
if v.version != "" && v.version != pkgVersion.GetVersion() {
continue
}
return true
}
return false
}