External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(cooldown): add dependency_cooldown.skip list (per-control exemption) (#328)

Browse Source 
Let dependency cooldown respect an explicit skip list so first-party /
internal packages that must be installed the moment they are published
(e.g. to sanity-test a freshly released version) are not held back by the
cooldown window.

Per review, this is a per-control skip list — NOT a second definition of
"trusted package". There remains a single top-level `trusted_packages`
(which waives malware analysis); `dependency_cooldown.skip` waives ONLY
the cooldown wait, so a fast-tracked package is still malware-scanned.

Matching:
- a PURL without a version skips cooldown for all versions of the package
  (package-level) — the metadata passes through unmodified;
- a PURL with a version skips cooldown for that version only — that
  version is preserved during stripping while other recent versions are
  still held.

- config: DependencyCooldownConfig.Skip + CooldownSkip()/CooldownSkipInfo.
- npm/pypi interceptors: bypass on package-level skip; thread per-version
  exemptions into the cooldown stripper so pinned versions survive.
- docs + config template; unit tests for the matcher (package/version
  level, precedence, mismatches) and the skip-vs-trusted independence.

Signed-off-by: dmdhrumilmistry <56185972+dmdhrumilmistry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
dmdhrumilmistry
2026-06-15 19:44:55 +05:30
committed by GitHub
co-authored by Claude Opus 4.8
parent 26d5c0ad71
commit 61230fbcd7
11 changed files with 372 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/interceptors/pypi_cooldown_test.go
+18 -18
View File
@@ -180,7 +180,7 @@ func TestStripCooldownFiles_MixedVersions(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 1, remaining)
@@ -213,7 +213,7 @@ func TestStripCooldownFiles_AllVersionsTooNew(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 2, stripped)
assert.Equal(t, 0, remaining)
@@ -238,7 +238,7 @@ func TestStripCooldownFiles_NoVersionsTooNew(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, 2, remaining)
assert.Equal(t, body, newBody)
@@ -256,7 +256,7 @@ func TestStripCooldownFiles_SingleVersionInCooldown(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
_, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
_, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 0, remaining)
}
@@ -287,8 +287,8 @@ func TestStripCooldownFiles_MultipleFilesPerVersion_AllStripped(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
assert.Equal(t, 1, stripped) // 1 version stripped
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped) // 1 version stripped
assert.Equal(t, 0, remaining)
var result struct {
@@ -303,7 +303,7 @@ func TestStripCooldownFiles_MalformedJSON(t *testing.T) {
body := []byte(`not-json`)
dates := map[string]time.Time{"1.0.0": time.Now().Add(-1 * time.Hour)}
newBody, stripped, _ := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, _ := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, body, newBody)
}
@@ -338,7 +338,7 @@ func TestStripCooldownFiles_UnparseableFilename_KeepFile(t *testing.T) {
forcedDates := map[string]time.Time{
"1.0.0": now.Add(-1 * 24 * time.Hour),
}
newBody, stripped, _ := handler.stripCooldownFiles(body, forcedDates, 5)
newBody, stripped, _ := handler.stripCooldownFiles(body, forcedDates, 5, nil)
assert.Equal(t, 1, stripped) // version is "stripped" from the date map perspective
var result struct {
@@ -357,7 +357,7 @@ func TestPyPICooldown_HandleMetadataRequest_OverridesHeaders(t *testing.T) {
ctx.Headers.Set("If-None-Match", `"abc123"`)
ctx.Headers.Set("If-Modified-Since", "Wed, 01 Jan 2025 00:00:00 GMT")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
assert.Equal(t, proxy.ActionModifyResponse, resp.Action)
assert.Equal(t, "application/vnd.pypi.simple.v1+json", ctx.Headers.Get("Accept"))
@@ -371,7 +371,7 @@ func TestPyPICooldown_HandleMetadataRequest_ClientWithoutPEP691_SkipsCooldown(t
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
ctx.Headers.Set("Accept", "text/html")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
assert.Equal(t, proxy.ActionAllow, resp.Action)
assert.Nil(t, resp.ResponseModifier)
@@ -383,7 +383,7 @@ func TestPyPICooldown_HandleMetadataRequest_NonJSONResponse_FailOpen(t *testing.
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -410,7 +410,7 @@ func TestPyPICooldown_HandleMetadataRequest_StripsRecentVersions(t *testing.T) {
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -448,7 +448,7 @@ func TestPyPICooldown_HandleMetadataRequest_AllVersionsInCooldown_RecordsStats(t
ctx := makeTestRequestContext("https://pypi.org/simple/newpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -482,7 +482,7 @@ func TestPyPICooldown_HandleMetadataRequest_NoVersionsInCooldown_BodyUnchanged(t
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -499,7 +499,7 @@ func TestPyPICooldown_HandleMetadataRequest_MalformedJSON_FailOpen(t *testing.T)
ctx := makeTestRequestContext("https://pypi.org/simple/badpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -526,7 +526,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionInCooldown_RecordsStats
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -561,7 +561,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionNotInCooldown_NoBlock(t
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -589,7 +589,7 @@ func TestPyPICooldown_HandleMetadataRequest_UnpinnedWithRemainingVersions_NoBloc
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)