mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Add experimental Go module proxy support (#358)
* feat: add experimental Go module support via pmg go Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command runs solely when invoked explicitly as `pmg go ...` and is deliberately excluded from setup aliases and PATH shims so existing users are unaffected. - packagemanager: goPackageManager with fail-safe command classification (vet/fix excluded from non-download since they can fetch on a cold cache) and pinned-version extraction where only canonical semver counts as explicit. - GOPROXY normalization (fail-closed): effective GOPROXY read via `go env` (honors go env -w), rebuilt comma-joined with `direct` dropped so a 403 block is terminal and nothing silently falls back to unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning; GOINSECURE is cleared. Contributed to the proxy flow through a new ProxyRoutingProvider hook (extra child env + dynamic MITM hosts). - Go interceptor with dynamic host matching from the user's effective GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on .zip only (the sole endpoint that delivers code); .info/.mod/@latest/ list pass through; /sumdb/ traffic and sum.golang.org are never touched so checksum-db verification stays intact; golang.org/toolchain is allowed on Go's own checksum verification. - Dependency cooldown: publish time captured from .info responses (body unmodified), in-window .zip blocked with 403; fails open for cooldown only when the publish time was never observed. - Cert gate: on macOS/Windows `pmg go` fails fast with actionable guidance unless the persisted PMG CA is OS-trusted (Go ignores SSL_CERT_FILE there); Linux works via the injected bundle. - proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic cases (allow/block/confirm, case-escaped paths, cooldown block and fail-open, toolchain, sumdb passthrough). Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0` MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch, and go.sum verification succeeds through the tunneled checksum db. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * fix(go): address review findings on experimental Go support - Drop fmt/clean from NonDownloadCommands: both load packages via go list and can download modules on a cold cache, which would bypass the proxy under install_only. - Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at https://corp/goproxy): the interceptor now receives host -> base URL and strips the path prefix before parsing module URLs, so verdicts and cooldown key on the real module path. - Default unschemed GOPROXY entries to https, matching go's own behavior, so corp mirrors configured as bare hosts are intercepted instead of silently unanalyzed. - Memoize the final verdict per module zip: go re-requests a failed zip during go get's load phase, which double-recorded stats (the report showed the same blocked module twice) and would have re-prompted on Confirm verdicts. - Fetch .info out-of-band on a cooldown cache miss: go serves .info from its local module cache on any machine that used go before PMG, which silently disabled cooldown. Failure of the side-fetch still fails open for cooldown only. - Move the noop package resolver into packagemanager. Verified live: cold-cache cooldown block now records once; warm-cache rerun is blocked via the side-fetch instead of failing open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * docs: collapse Go proxy-mode details by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK --------- Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Abhisek Datta
co-authored by
Claude Fable 5
Claude Fable 5
parent
648adcbda4
commit
b19473945b
@@ -0,0 +1,142 @@
|
||||
package packagemanager
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"os/exec"
|
||||
"strings"
|
||||
|
||||
"github.com/safedep/dry/log"
|
||||
)
|
||||
|
||||
// ProxyRouting is per-run routing a package manager contributes to the proxy
|
||||
// flow before the proxied child process launches. ExtraEnv is appended to the
|
||||
// standard proxy env injection. MITMHosts maps registry hostnames the proxy
|
||||
// must intercept dynamically to the upstream base URL packages are served
|
||||
// under (scheme + host + optional path prefix) — Go's module proxy is
|
||||
// user-configurable via GOPROXY, unlike npm/PyPI's fixed registry hosts.
|
||||
type ProxyRouting struct {
|
||||
ExtraEnv []string
|
||||
MITMHosts map[string]string
|
||||
}
|
||||
|
||||
// ProxyRoutingProvider is implemented by package managers that need
|
||||
// run-specific proxy routing.
|
||||
type ProxyRoutingProvider interface {
|
||||
ProxyRouting(ctx context.Context) (*ProxyRouting, error)
|
||||
}
|
||||
|
||||
const defaultGoProxyURL = "https://proxy.golang.org"
|
||||
|
||||
var _ ProxyRoutingProvider = &goPackageManager{}
|
||||
|
||||
// ProxyRouting computes the child's GOPROXY and the module-proxy hosts to
|
||||
// MITM from the effective go env. GOPRIVATE/GONOPROXY are left untouched for
|
||||
// the user's private modules but surfaced as a warning since matching modules
|
||||
// bypass analysis; GOINSECURE is cleared so module traffic cannot be
|
||||
// downgraded to plaintext HTTP.
|
||||
func (g *goPackageManager) ProxyRouting(ctx context.Context) (*ProxyRouting, error) {
|
||||
env, err := readEffectiveGoEnv(ctx, "GOPROXY", "GOPRIVATE", "GONOPROXY", "GOINSECURE")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
childGoProxy, mitmHosts := normalizeGoProxy(env["GOPROXY"])
|
||||
|
||||
for _, key := range []string{"GOPRIVATE", "GONOPROXY"} {
|
||||
if v := env[key]; v != "" {
|
||||
log.Warnf("%s=%q: matching modules are fetched directly from their VCS host and are NOT analyzed by PMG", key, v)
|
||||
}
|
||||
}
|
||||
|
||||
routing := &ProxyRouting{
|
||||
ExtraEnv: []string{fmt.Sprintf("GOPROXY=%s", childGoProxy)},
|
||||
MITMHosts: mitmHosts,
|
||||
}
|
||||
|
||||
if env["GOINSECURE"] != "" {
|
||||
log.Warnf("GOINSECURE is set; PMG clears it for this run so module traffic cannot be downgraded to plaintext HTTP")
|
||||
routing.ExtraEnv = append(routing.ExtraEnv, "GOINSECURE=")
|
||||
}
|
||||
|
||||
return routing, nil
|
||||
}
|
||||
|
||||
// readEffectiveGoEnv reads go env values honoring both the process environment
|
||||
// and the user's persisted GOENV file (go env -w), which plain os.Getenv would
|
||||
// miss.
|
||||
func readEffectiveGoEnv(ctx context.Context, keys ...string) (map[string]string, error) {
|
||||
out, err := exec.CommandContext(ctx, "go", append([]string{"env", "-json"}, keys...)...).Output()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to read go env (is the Go toolchain installed and on PATH?): %w", err)
|
||||
}
|
||||
|
||||
values := map[string]string{}
|
||||
if err := json.Unmarshal(out, &values); err != nil {
|
||||
return nil, fmt.Errorf("failed to parse go env output: %w", err)
|
||||
}
|
||||
|
||||
return values, nil
|
||||
}
|
||||
|
||||
// normalizeGoProxy rebuilds the child's GOPROXY as a fail-closed proxy list
|
||||
// and returns the hostnames to MITM mapped to their upstream base URL (used
|
||||
// for base-path stripping and out-of-band .info fetches):
|
||||
//
|
||||
// - `direct` entries are dropped so a module PMG cannot inspect fails with
|
||||
// an error instead of silently bypassing analysis via a VCS fetch.
|
||||
// - Pipe (|) separators collapse to comma so a PMG block (HTTP 403) is
|
||||
// terminal rather than falling through to the next entry.
|
||||
// - `off` is kept: it is already fail-closed (no network at all).
|
||||
// - Unschemed entries (go treats them as https) are rewritten with an
|
||||
// explicit https:// scheme so they are unambiguous and interceptable.
|
||||
// - file:// proxies are local (no network) and kept verbatim; there is no
|
||||
// host to intercept.
|
||||
//
|
||||
// If nothing remains (GOPROXY was direct-only), the public Go proxy is
|
||||
// injected so module downloads stay analyzable.
|
||||
func normalizeGoProxy(goproxy string) (child string, mitmHosts map[string]string) {
|
||||
if strings.TrimSpace(goproxy) == "" {
|
||||
goproxy = defaultGoProxyURL + ",direct"
|
||||
}
|
||||
|
||||
mitmHosts = map[string]string{}
|
||||
|
||||
var kept []string
|
||||
droppedDirect := false
|
||||
for _, entry := range strings.FieldsFunc(goproxy, func(r rune) bool { return r == ',' || r == '|' }) {
|
||||
entry = strings.TrimSpace(entry)
|
||||
if entry == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
if entry == "direct" {
|
||||
droppedDirect = true
|
||||
continue
|
||||
}
|
||||
|
||||
if entry != "off" && !strings.Contains(entry, "://") {
|
||||
entry = "https://" + entry
|
||||
}
|
||||
|
||||
kept = append(kept, entry)
|
||||
|
||||
if u, err := url.Parse(entry); err == nil && u.Hostname() != "" && (u.Scheme == "https" || u.Scheme == "http") {
|
||||
mitmHosts[u.Hostname()] = strings.TrimSuffix(entry, "/")
|
||||
}
|
||||
}
|
||||
|
||||
if droppedDirect {
|
||||
log.Warnf("Removed 'direct' from GOPROXY for this run: modules unavailable on the module proxy fail instead of bypassing analysis")
|
||||
}
|
||||
|
||||
if len(kept) == 0 {
|
||||
log.Warnf("GOPROXY=%q has no usable module proxy; PMG routes module downloads via %s for analysis", goproxy, defaultGoProxyURL)
|
||||
kept = append(kept, defaultGoProxyURL)
|
||||
mitmHosts["proxy.golang.org"] = defaultGoProxyURL
|
||||
}
|
||||
|
||||
return strings.Join(kept, ","), mitmHosts
|
||||
}
|
||||
Reference in New Issue
Block a user