External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(cooldown): add dependency_cooldown.skip list (per-control exemption) (#328)

Browse Source 
Let dependency cooldown respect an explicit skip list so first-party /
internal packages that must be installed the moment they are published
(e.g. to sanity-test a freshly released version) are not held back by the
cooldown window.

Per review, this is a per-control skip list — NOT a second definition of
"trusted package". There remains a single top-level `trusted_packages`
(which waives malware analysis); `dependency_cooldown.skip` waives ONLY
the cooldown wait, so a fast-tracked package is still malware-scanned.

Matching:
- a PURL without a version skips cooldown for all versions of the package
  (package-level) — the metadata passes through unmodified;
- a PURL with a version skips cooldown for that version only — that
  version is preserved during stripping while other recent versions are
  still held.

- config: DependencyCooldownConfig.Skip + CooldownSkip()/CooldownSkipInfo.
- npm/pypi interceptors: bypass on package-level skip; thread per-version
  exemptions into the cooldown stripper so pinned versions survive.
- docs + config template; unit tests for the matcher (package/version
  level, precedence, mismatches) and the skip-vs-trusted independence.

Signed-off-by: dmdhrumilmistry <56185972+dmdhrumilmistry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
dmdhrumilmistry
2026-06-15 19:44:55 +05:30
committed by GitHub
co-authored by Claude Opus 4.8
parent 26d5c0ad71
commit 61230fbcd7
11 changed files with 372 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/interceptors/pypi_registry.go
+14 -1
View File
@@ -126,7 +126,20 @@ func (i *PypiRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*pro
// for version resolution. JSON API requests (/pypi/{pkg}/json) are allowed through;
// they have a different response structure and pip does not use them for installs.
if depCooldownConfig.Enabled && strings.HasPrefix(ctx.URL.Path, "/simple/") {
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()])
// Match the skip list against the normalized name (lowercase, _/. → -),
// the same canonical form used for pinned-version lookups, so a PURL
// like pkg:pypi/My_Pkg reliably matches the resolved request name.
skip := pmgconfig.CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_PYPI, denormalizePyPIPackageName(pkgInfo.GetName()))
if skip.SkipAll {
// Whole package is on the cooldown skip list: pass metadata through
// unmodified. The tarball download still hits analyzePackage, so
// malware analysis is preserved.
log.Infof("[%s] Cooldown: package %s is on the skip list (dependency_cooldown.skip); malware analysis still applies", ctx.RequestID, pkgInfo.GetName())
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
}
// Version-pinned skip entries (if any) are preserved during stripping.
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()], skip.Versions)
}
log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, pkgInfo.GetName())