Add experimental Go module proxy support (#358)

* feat: add experimental Go module support via pmg go

Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command
runs solely when invoked explicitly as `pmg go ...` and is deliberately
excluded from setup aliases and PATH shims so existing users are
unaffected.

- packagemanager: goPackageManager with fail-safe command classification
  (vet/fix excluded from non-download since they can fetch on a cold
  cache) and pinned-version extraction where only canonical semver
  counts as explicit.
- GOPROXY normalization (fail-closed): effective GOPROXY read via
  `go env` (honors go env -w), rebuilt comma-joined with `direct`
  dropped so a 403 block is terminal and nothing silently falls back to
  unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning;
  GOINSECURE is cleared. Contributed to the proxy flow through a new
  ProxyRoutingProvider hook (extra child env + dynamic MITM hosts).
- Go interceptor with dynamic host matching from the user's effective
  GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on
  .zip only (the sole endpoint that delivers code); .info/.mod/@latest/
  list pass through; /sumdb/ traffic and sum.golang.org are never
  touched so checksum-db verification stays intact; golang.org/toolchain
  is allowed on Go's own checksum verification.
- Dependency cooldown: publish time captured from .info responses
  (body unmodified), in-window .zip blocked with 403; fails open for
  cooldown only when the publish time was never observed.
- Cert gate: on macOS/Windows `pmg go` fails fast with actionable
  guidance unless the persisted PMG CA is OS-trusted (Go ignores
  SSL_CERT_FILE there); Linux works via the injected bundle.
- proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic
  cases (allow/block/confirm, case-escaped paths, cooldown block and
  fail-open, toolchain, sumdb passthrough).

Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0`
MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch,
and go.sum verification succeeds through the tunneled checksum db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* fix(go): address review findings on experimental Go support

- Drop fmt/clean from NonDownloadCommands: both load packages via go
  list and can download modules on a cold cache, which would bypass the
  proxy under install_only.
- Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at
  https://corp/goproxy): the interceptor now receives host -> base URL
  and strips the path prefix before parsing module URLs, so verdicts
  and cooldown key on the real module path.
- Default unschemed GOPROXY entries to https, matching go's own
  behavior, so corp mirrors configured as bare hosts are intercepted
  instead of silently unanalyzed.
- Memoize the final verdict per module zip: go re-requests a failed
  zip during go get's load phase, which double-recorded stats (the
  report showed the same blocked module twice) and would have
  re-prompted on Confirm verdicts.
- Fetch .info out-of-band on a cooldown cache miss: go serves .info
  from its local module cache on any machine that used go before PMG,
  which silently disabled cooldown. Failure of the side-fetch still
  fails open for cooldown only.
- Move the noop package resolver into packagemanager.

Verified live: cold-cache cooldown block now records once; warm-cache
rerun is blocked via the side-fetch instead of failing open.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* docs: collapse Go proxy-mode details by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

---------

Co-authored-by: Claude <noreply@anthropic.com>

proxy/interceptors/audit_logger.go

@@ -46,6 +46,16 @@ func (i *AuditLoggerInterceptor) HandleRequest(ctx *proxy.RequestContext) (*prox
 	return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
 }
 
+// wellKnownGoHosts are the default Go module-proxy and checksum-database
+// hosts. Custom GOPROXY hosts are dynamic (known only to the Go interceptor's
+// per-run config) and intentionally still surface here as observed hosts.
+var wellKnownGoHosts = map[string]bool{
+	"proxy.golang.org": true,
+	"sum.golang.org":   true,
+}
+
 func (i *AuditLoggerInterceptor) isKnownRegistryHost(hostname string) bool {
-	return npmRegistryDomains.ContainsHostname(hostname) || pypiRegistryDomains.ContainsHostname(hostname)
+	return npmRegistryDomains.ContainsHostname(hostname) ||
+		pypiRegistryDomains.ContainsHostname(hostname) ||
+		wellKnownGoHosts[hostname]
 }

proxy/interceptors/factory.go

@@ -13,6 +13,13 @@ import (
 // (analyzer, cache, stats), this holds context specific to the current run.
 type InterceptorContext struct {
 	PinnedVersions map[string]string
+
+	// GoProxyBaseURLs maps module-proxy hostnames from the user's effective
+	// GOPROXY to their upstream base URL (scheme + host + optional path
+	// prefix). The Go interceptor MITMs and analyzes these hosts; Go is the
+	// only ecosystem whose registry hosts are user-configurable rather than
+	// fixed.
+	GoProxyBaseURLs map[string]string
 }
 
 // InterceptorFactory creates ecosystem-specific interceptors for the proxy
@@ -63,6 +70,15 @@ func (f *InterceptorFactory) CreateInterceptor(ecosystem packagev1.Ecosystem) (p
 			f.execContext,
 		), nil
 
+	case packagev1.Ecosystem_ECOSYSTEM_GO:
+		return NewGoRegistryInterceptor(
+			f.analyzer,
+			f.cache,
+			f.statsCollector,
+			f.confirmationChan,
+			f.execContext,
+		), nil
+
 	default:
 		return nil, fmt.Errorf("proxy-based interception not yet supported for ecosystem: %s", ecosystem.String())
 	}
@@ -73,6 +89,7 @@ func SupportedEcosystems() []packagev1.Ecosystem {
 	return []packagev1.Ecosystem{
 		packagev1.Ecosystem_ECOSYSTEM_NPM,
 		packagev1.Ecosystem_ECOSYSTEM_PYPI,
+		packagev1.Ecosystem_ECOSYSTEM_GO,
 	}
 }
 

proxy/interceptors/go_cooldown.go

@@ -0,0 +1,189 @@
+package interceptors
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	"github.com/safedep/dry/log"
+	pmgconfig "github.com/safedep/pmg/config"
+	"github.com/safedep/pmg/internal/audit"
+	"github.com/safedep/pmg/proxy"
+	gomodule "golang.org/x/mod/module"
+)
+
+// goCooldownHandler enforces dependency cooldown for Go modules. Unlike npm,
+// there is no metadata to strip: the version go requests is already resolved
+// by the time the proxy sees it. Instead the publish timestamp is captured
+// from the .info response go fetches before each .zip, and an in-window .zip
+// download is blocked with HTTP 403 — terminal, because the child GOPROXY is
+// normalized to a comma-joined list with no direct fallback.
+type goCooldownHandler struct {
+	statsCollector *AnalysisStatsCollector
+
+	mu           sync.Mutex
+	publishTimes map[string]time.Time
+}
+
+func newGoCooldownHandler(statsCollector *AnalysisStatsCollector) *goCooldownHandler {
+	return &goCooldownHandler{
+		statsCollector: statsCollector,
+		publishTimes:   map[string]time.Time{},
+	}
+}
+
+func goModuleVersionKey(module, version string) string {
+	return module + "@" + version
+}
+
+// HandleInfoRequest reads the .info response body without altering it and
+// caches the version's publish time for the upcoming .zip request.
+func (h *goCooldownHandler) HandleInfoRequest(ctx *proxy.RequestContext, module, version string) (*proxy.InterceptorResponse, error) {
+	// Force an uncompressed, non-conditional response so the body is parseable
+	// JSON rather than raw gzip bytes or an empty 304 (same as the npm
+	// metadata modifier).
+	ctx.Headers.Set("Accept-Encoding", "identity")
+	ctx.Headers.Del("If-None-Match")
+	ctx.Headers.Del("If-Modified-Since")
+
+	modifier := func(statusCode int, headers http.Header, body []byte) (int, http.Header, []byte, error) {
+		if statusCode != http.StatusOK {
+			return statusCode, headers, body, nil
+		}
+
+		var info struct {
+			Time time.Time `json:"Time"`
+		}
+		if err := json.Unmarshal(body, &info); err != nil || info.Time.IsZero() {
+			log.Warnf("[%s] Cooldown: failed to parse publish time from .info for %s@%s", ctx.RequestID, module, version)
+			return statusCode, headers, body, nil
+		}
+
+		h.mu.Lock()
+		h.publishTimes[goModuleVersionKey(module, version)] = info.Time
+		h.mu.Unlock()
+
+		return statusCode, headers, body, nil
+	}
+
+	return &proxy.InterceptorResponse{
+		Action:           proxy.ActionModifyResponse,
+		ResponseModifier: modifier,
+	}, nil
+}
+
+// CheckZipDownload blocks the module zip when its publish time is within the
+// cooldown window. handled=false lets the request continue to malware
+// analysis. When the publish time was not observed on the wire (go served
+// .info from its local module cache, common on machines that used go before
+// PMG), it is fetched out-of-band from the upstream proxy; only if that also
+// fails does cooldown fail open — malware analysis still runs.
+func (h *goCooldownHandler) CheckZipDownload(ctx *proxy.RequestContext, baseURL, module, version string, cooldownDays int) (*proxy.InterceptorResponse, bool) {
+	skip := pmgconfig.CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_GO, module)
+	if skip.SkipAll || pmgconfig.IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_GO, module, version) {
+		return nil, false
+	}
+
+	h.mu.Lock()
+	publishTime, ok := h.publishTimes[goModuleVersionKey(module, version)]
+	h.mu.Unlock()
+
+	if !ok {
+		publishTime, ok = h.fetchPublishTime(ctx, baseURL, module, version)
+	}
+
+	if !ok {
+		log.Warnf("[%s] Cooldown: no publish time available for %s@%s; cooldown not enforced for this download", ctx.RequestID, module, version)
+		return nil, false
+	}
+
+	within, daysAgo, daysLeft := cooldownIsWithinWindow(publishTime, cooldownDays)
+	if !within {
+		return nil, false
+	}
+
+	if skip.ExemptsVersion(version) {
+		auditCooldownSkips(ctx.RequestID, packagev1.Ecosystem_ECOSYSTEM_GO, module, cooldownExemptions{skipListed: []string{version}})
+		return nil, false
+	}
+
+	log.Infof("[%s] Cooldown: blocking %s@%s published %d day(s) ago (%d day cooldown, %d remaining)",
+		ctx.RequestID, module, version, daysAgo, cooldownDays, daysLeft)
+
+	if h.statsCollector != nil {
+		h.statsCollector.RecordCooldownBlocked(module, version, publishTime, daysAgo, daysLeft, cooldownDays)
+	}
+
+	pv := &packagev1.PackageVersion{}
+	pv.SetPackage(&packagev1.Package{})
+	pv.GetPackage().SetName(module)
+	pv.GetPackage().SetEcosystem(packagev1.Ecosystem_ECOSYSTEM_GO)
+	pv.SetVersion(version)
+	audit.LogDependencyCooldown(pv, publishTime, cooldownDays, daysAgo, daysLeft)
+
+	message := fmt.Sprintf("Package blocked by dependency cooldown: GO/%s@%s\n\nPublished %d day(s) ago; cooldown window is %d day(s) (%d remaining).",
+		module, version, daysAgo, cooldownDays, daysLeft)
+
+	return &proxy.InterceptorResponse{
+		Action:       proxy.ActionBlock,
+		BlockCode:    http.StatusForbidden,
+		BlockMessage: message,
+	}, true
+}
+
+// goInfoFetchClient fetches .info out-of-band, straight to the upstream proxy
+// rather than back through PMG's own in-process proxy (which would
+// re-intercept the request). It honors the process' own proxy environment,
+// not the child's injected one.
+var goInfoFetchClient = &http.Client{Timeout: 10 * time.Second}
+
+// fetchPublishTime performs a one-shot authoritative $base/$module/@v/$version.info
+// fetch and caches the result. Best-effort: any failure means no publish time.
+func (h *goCooldownHandler) fetchPublishTime(ctx *proxy.RequestContext, baseURL, module, version string) (time.Time, bool) {
+	if baseURL == "" {
+		return time.Time{}, false
+	}
+
+	escapedPath, err := gomodule.EscapePath(module)
+	if err != nil {
+		return time.Time{}, false
+	}
+
+	escapedVersion, err := gomodule.EscapeVersion(version)
+	if err != nil {
+		return time.Time{}, false
+	}
+
+	infoURL := fmt.Sprintf("%s/%s/@v/%s.info", strings.TrimSuffix(baseURL, "/"), escapedPath, escapedVersion)
+
+	resp, err := goInfoFetchClient.Get(infoURL)
+	if err != nil {
+		log.Warnf("[%s] Cooldown: failed to fetch %s: %v", ctx.RequestID, infoURL, err)
+		return time.Time{}, false
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Warnf("[%s] Cooldown: fetching %s returned HTTP %d", ctx.RequestID, infoURL, resp.StatusCode)
+		return time.Time{}, false
+	}
+
+	var info struct {
+		Time time.Time `json:"Time"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&info); err != nil || info.Time.IsZero() {
+		log.Warnf("[%s] Cooldown: failed to parse publish time from %s", ctx.RequestID, infoURL)
+		return time.Time{}, false
+	}
+
+	h.mu.Lock()
+	h.publishTimes[goModuleVersionKey(module, version)] = info.Time
+	h.mu.Unlock()
+
+	return info.Time, true
+}

proxy/interceptors/go_cooldown_test.go

@@ -0,0 +1,57 @@
+package interceptors
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/safedep/pmg/proxy"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGoCooldownCheckZipDownloadSideFetch(t *testing.T) {
+	publishTime := time.Now().Add(-24 * time.Hour)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		switch req.URL.Path {
+		case "/example.com/fresh/@v/v1.1.0.info":
+			w.Header().Set("Content-Type", "application/json")
+			err := json.NewEncoder(w).Encode(map[string]string{
+				"Version": "v1.1.0",
+				"Time":    publishTime.UTC().Format(time.RFC3339),
+			})
+			require.NoError(t, err)
+		default:
+			http.NotFound(w, req)
+		}
+	}))
+	defer server.Close()
+
+	ctx := &proxy.RequestContext{RequestID: "test"}
+
+	t.Run("blocks using out-of-band publish time on cache miss", func(t *testing.T) {
+		h := newGoCooldownHandler(NewAnalysisStatsCollector())
+
+		resp, handled := h.CheckZipDownload(ctx, server.URL, "example.com/fresh", "v1.1.0", 7)
+		require.True(t, handled)
+		assert.Equal(t, proxy.ActionBlock, resp.Action)
+		assert.Equal(t, http.StatusForbidden, resp.BlockCode)
+	})
+
+	t.Run("fails open when the out-of-band fetch fails", func(t *testing.T) {
+		h := newGoCooldownHandler(NewAnalysisStatsCollector())
+
+		_, handled := h.CheckZipDownload(ctx, server.URL, "example.com/unknown", "v9.9.9", 7)
+		assert.False(t, handled)
+	})
+
+	t.Run("fails open without a base URL", func(t *testing.T) {
+		h := newGoCooldownHandler(NewAnalysisStatsCollector())
+
+		_, handled := h.CheckZipDownload(ctx, "", "example.com/fresh", "v1.1.0", 7)
+		assert.False(t, handled)
+	})
+}

proxy/interceptors/go_registry.go

@@ -0,0 +1,205 @@
+package interceptors
+
+import (
+	"net/url"
+	"strings"
+	"sync"
+
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/analyzer"
+	pmgconfig "github.com/safedep/pmg/config"
+	"github.com/safedep/pmg/proxy"
+)
+
+// goToolchainModule is the module path Go uses to auto-download toolchains
+// (GOTOOLCHAIN=auto). Toolchain zips are verified by go against the checksum
+// database regardless of GOPRIVATE/GONOSUMDB, and downloads fail closed when
+// GOSUMDB=off, so PMG passes them through on Go's own verification instead of
+// treating them as ordinary (never-flagged) modules.
+const goToolchainModule = "golang.org/toolchain"
+
+// GoRegistryInterceptor intercepts Go module proxy requests and analyzes
+// module zips for malware. Unlike npm/PyPI, the registry hosts are not fixed:
+// they come from the user's effective GOPROXY via
+// InterceptorContext.GoProxyBaseURLs. sum.golang.org is never in that set, so
+// checksum-database traffic is tunneled, not MITM'd.
+type GoRegistryInterceptor struct {
+	baseRegistryInterceptor
+	domains         registryConfigMap
+	baseURLs        map[string]string
+	cooldownHandler *goCooldownHandler
+
+	// zipVerdicts memoizes the final response per module zip. go re-requests
+	// a failed zip (once more during go get's load phase), and without this
+	// the repeat would double-record stats — the report would show the same
+	// blocked module twice — and re-prompt the user on a Confirm verdict.
+	zipVerdictsMu sync.Mutex
+	zipVerdicts   map[string]*proxy.InterceptorResponse
+}
+
+var _ proxy.Interceptor = (*GoRegistryInterceptor)(nil)
+var _ proxy.MITMDecider = (*GoRegistryInterceptor)(nil)
+
+func NewGoRegistryInterceptor(
+	analyzer analyzer.PackageVersionAnalyzer,
+	cache AnalysisCache,
+	statsCollector *AnalysisStatsCollector,
+	confirmationChan chan *ConfirmationRequest,
+	execContext InterceptorContext,
+) *GoRegistryInterceptor {
+	domains := registryConfigMap{}
+	baseURLs := map[string]string{}
+	for host, baseURL := range execContext.GoProxyBaseURLs {
+		basePath := ""
+		if u, err := url.Parse(baseURL); err == nil {
+			basePath = strings.TrimSuffix(u.Path, "/")
+		}
+
+		domains[host] = &registryConfig{
+			Host:                 host,
+			SupportedForAnalysis: true,
+			Parser:               goProxyParser{basePath: basePath},
+		}
+		baseURLs[host] = baseURL
+	}
+
+	return &GoRegistryInterceptor{
+		baseRegistryInterceptor: baseRegistryInterceptor{
+			analyzer:         analyzer,
+			cache:            cache,
+			statsCollector:   statsCollector,
+			confirmationChan: confirmationChan,
+			circuitBreaker:   newAnalyzerCircuitBreaker("malysis-analyzer-go"),
+			execContext:      execContext,
+		},
+		domains:         domains,
+		baseURLs:        baseURLs,
+		cooldownHandler: newGoCooldownHandler(statsCollector),
+		zipVerdicts:     map[string]*proxy.InterceptorResponse{},
+	}
+}
+
+func (i *GoRegistryInterceptor) Name() string {
+	return "go-registry-interceptor"
+}
+
+func (i *GoRegistryInterceptor) ShouldMITM(ctx *proxy.RequestContext) bool {
+	config := i.domains.GetConfigForHostname(ctx.Hostname)
+	if config == nil {
+		return false
+	}
+
+	return config.SupportedForAnalysis
+}
+
+func (i *GoRegistryInterceptor) ShouldIntercept(ctx *proxy.RequestContext) bool {
+	return i.domains.ContainsHostname(ctx.Hostname)
+}
+
+// HandleRequest processes the request and returns response action.
+// We take a fail-open approach here, allowing requests that we can't parse the
+// package information from the URL — but an unparseable .zip means an
+// unanalyzed source download, so that case is logged loudly.
+func (i *GoRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*proxy.InterceptorResponse, error) {
+	log.Debugf("[%s] Handling Go module proxy request: %s", ctx.RequestID, ctx.URL.Path)
+
+	config := i.domains.GetConfigForHostname(ctx.Hostname)
+	if config == nil {
+		log.Warnf("[%s] No registry config found for hostname: %s", ctx.RequestID, ctx.Hostname)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	pkgInfo, err := config.Parser.ParseURL(ctx.URL.Path)
+	if err != nil {
+		if strings.HasSuffix(ctx.URL.Path, ".zip") {
+			log.Warnf("[%s] Failed to parse Go module proxy zip URL %s: %v — download allowed without analysis",
+				ctx.RequestID, ctx.URL.Path, err)
+		} else {
+			log.Debugf("[%s] Failed to parse Go module proxy URL %s: %v", ctx.RequestID, ctx.URL.Path, err)
+		}
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	info, ok := pkgInfo.(*goModuleInfo)
+	if !ok {
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	if info.requestType == goRequestSumDB {
+		log.Debugf("[%s] Allowing proxied checksum-database request: %s", ctx.RequestID, ctx.URL.Path)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	if info.name == goToolchainModule {
+		if info.IsFileDownload() {
+			log.Infof("[%s] Allowing Go toolchain download %s@%s (verified by Go's checksum database)",
+				ctx.RequestID, info.name, info.version)
+		}
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	depCooldownConfig := pmgconfig.Get().Config.DependencyCooldown
+
+	if !info.IsFileDownload() {
+		if info.requestType == goRequestInfo && info.version != "" && depCooldownConfig.Enabled {
+			return i.cooldownHandler.HandleInfoRequest(ctx, info.name, info.version)
+		}
+
+		log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, info.name)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	key := goModuleVersionKey(info.name, info.version)
+
+	i.zipVerdictsMu.Lock()
+	memo := i.zipVerdicts[key]
+	i.zipVerdictsMu.Unlock()
+	if memo != nil {
+		log.Debugf("[%s] Reusing verdict for repeated zip request: %s", ctx.RequestID, key)
+		return memo, nil
+	}
+
+	resp, memoize, err := i.handleZipDownload(ctx, config, info, depCooldownConfig)
+	if err != nil {
+		return resp, err
+	}
+
+	if memoize {
+		i.zipVerdictsMu.Lock()
+		i.zipVerdicts[key] = resp
+		i.zipVerdictsMu.Unlock()
+	}
+
+	return resp, nil
+}
+
+// handleZipDownload runs the security controls for a module source download:
+// dependency cooldown, then trusted/insecure fast-allow, then malware
+// analysis. memoize is false only when the outcome is a fail-open allow after
+// an analyzer error, so a retried request gets another chance to be analyzed.
+func (i *GoRegistryInterceptor) handleZipDownload(
+	ctx *proxy.RequestContext,
+	config *registryConfig,
+	info *goModuleInfo,
+	depCooldownConfig pmgconfig.DependencyCooldownConfig,
+) (*proxy.InterceptorResponse, bool, error) {
+	if depCooldownConfig.Enabled {
+		if resp, handled := i.cooldownHandler.CheckZipDownload(ctx, i.baseURLs[config.Host], info.name, info.version, depCooldownConfig.Days); handled {
+			return resp, true, nil
+		}
+	}
+
+	if resp, ok := i.fastAllow(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version); ok {
+		return resp, true, nil
+	}
+
+	result, err := i.analyzePackage(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version)
+	if err != nil {
+		log.Errorf("[%s] Failed to analyze package %s@%s: %v", ctx.RequestID, info.name, info.version, err)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, false, nil
+	}
+
+	resp, err := i.handleAnalysisResult(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version, result)
+	return resp, err == nil, err
+}

proxy/interceptors/go_registry_test.go

@@ -0,0 +1,43 @@
+package interceptors
+
+import (
+	"testing"
+
+	"github.com/safedep/pmg/proxy"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGoRegistryInterceptorHostMatching(t *testing.T) {
+	interceptor := NewGoRegistryInterceptor(nil, nil, nil, nil, InterceptorContext{
+		GoProxyBaseURLs: map[string]string{
+			"proxy.golang.org": "https://proxy.golang.org",
+			"corp.example.com": "https://corp.example.com/goproxy",
+		},
+	})
+
+	cases := []struct {
+		hostname      string
+		wantIntercept bool
+		wantMITM      bool
+	}{
+		{"proxy.golang.org", true, true},
+		{"corp.example.com", true, true},
+		{"sum.golang.org", false, false},
+		{"github.com", false, false},
+		{"registry.npmjs.org", false, false},
+	}
+
+	for _, tc := range cases {
+		ctx := &proxy.RequestContext{Hostname: tc.hostname}
+		assert.Equal(t, tc.wantIntercept, interceptor.ShouldIntercept(ctx), "ShouldIntercept(%s)", tc.hostname)
+		assert.Equal(t, tc.wantMITM, interceptor.ShouldMITM(ctx), "ShouldMITM(%s)", tc.hostname)
+	}
+}
+
+func TestGoRegistryInterceptorNoHosts(t *testing.T) {
+	interceptor := NewGoRegistryInterceptor(nil, nil, nil, nil, InterceptorContext{})
+
+	ctx := &proxy.RequestContext{Hostname: "proxy.golang.org"}
+	assert.False(t, interceptor.ShouldIntercept(ctx))
+	assert.False(t, interceptor.ShouldMITM(ctx))
+}

proxy/interceptors/go_url_parser.go

@@ -0,0 +1,122 @@
+package interceptors
+
+import (
+	"fmt"
+	"strings"
+
+	"golang.org/x/mod/module"
+)
+
+const (
+	goRequestLatest = "latest"
+	goRequestList   = "list"
+	goRequestInfo   = "info"
+	goRequestMod    = "mod"
+	goRequestZip    = "zip"
+
+	// goRequestSumDB is checksum-database traffic proxied through the module
+	// proxy ($GOPROXY/sumdb/...). It is passed through unmodified so go's
+	// signature verification stays intact.
+	goRequestSumDB = "sumdb"
+)
+
+// goModuleInfo is parsed module information from a Go module proxy URL.
+type goModuleInfo struct {
+	name        string
+	version     string
+	requestType string
+}
+
+var _ packageInfo = (*goModuleInfo)(nil)
+
+func (g *goModuleInfo) GetName() string { return g.name }
+
+func (g *goModuleInfo) GetVersion() string { return g.version }
+
+// IsFileDownload is true only for .zip: the single endpoint that downloads
+// module source. .info/.mod are fetched for the entire candidate graph during
+// version selection, including modules never selected into the build, so
+// analyzing them would block builds over code that never lands in the cache.
+func (g *goModuleInfo) IsFileDownload() bool { return g.requestType == goRequestZip }
+
+// goProxyParser parses Go module proxy URLs per the GOPROXY protocol
+// (https://go.dev/ref/mod#goproxy-protocol):
+//
+//	/<module>/@latest            -> latest version metadata
+//	/<module>/@v/list            -> version list
+//	/<module>/@v/<version>.info  -> version metadata JSON (publish time)
+//	/<module>/@v/<version>.mod   -> go.mod file
+//	/<module>/@v/<version>.zip   -> module source archive
+//	/sumdb/<name>/...            -> proxied checksum-database traffic
+//
+// Uppercase letters in module path and version arrive escaped as '!'+lowercase
+// and are decoded before use as Malysis query keys.
+//
+// basePath is the path prefix of the GOPROXY entry (e.g. "/goproxy" for
+// GOPROXY=https://corp.example.com/goproxy): go sends requests under that
+// base, so it is stripped before the module path is parsed.
+type goProxyParser struct {
+	basePath string
+}
+
+var _ registryURLParser = goProxyParser{}
+
+func (g goProxyParser) ParseURL(urlPath string) (packageInfo, error) {
+	if g.basePath != "" {
+		rest, ok := strings.CutPrefix(urlPath, g.basePath)
+		if !ok || (rest != "" && rest[0] != '/') {
+			return nil, fmt.Errorf("go proxy URL %q is outside proxy base path %q", urlPath, g.basePath)
+		}
+		urlPath = rest
+	}
+
+	p := strings.TrimPrefix(urlPath, "/")
+	if p == "" {
+		return nil, fmt.Errorf("empty go proxy URL path")
+	}
+
+	if p == "sumdb" || strings.HasPrefix(p, "sumdb/") {
+		return &goModuleInfo{requestType: goRequestSumDB}, nil
+	}
+
+	if escaped, ok := strings.CutSuffix(p, "/@latest"); ok {
+		name, err := module.UnescapePath(escaped)
+		if err != nil {
+			return nil, fmt.Errorf("invalid module path in go proxy URL: %w", err)
+		}
+		return &goModuleInfo{name: name, requestType: goRequestLatest}, nil
+	}
+
+	escapedPath, versionPart, ok := strings.Cut(p, "/@v/")
+	if !ok {
+		return nil, fmt.Errorf("go proxy URL missing /@v/ or /@latest marker")
+	}
+
+	name, err := module.UnescapePath(escapedPath)
+	if err != nil {
+		return nil, fmt.Errorf("invalid module path in go proxy URL: %w", err)
+	}
+
+	if versionPart == "list" {
+		return &goModuleInfo{name: name, requestType: goRequestList}, nil
+	}
+
+	dot := strings.LastIndex(versionPart, ".")
+	if dot <= 0 {
+		return nil, fmt.Errorf("go proxy URL has no version suffix: %q", versionPart)
+	}
+
+	requestType := versionPart[dot+1:]
+	switch requestType {
+	case goRequestInfo, goRequestMod, goRequestZip:
+	default:
+		return nil, fmt.Errorf("unrecognized go proxy version suffix: %q", requestType)
+	}
+
+	version, err := module.UnescapeVersion(versionPart[:dot])
+	if err != nil {
+		return nil, fmt.Errorf("invalid version in go proxy URL: %w", err)
+	}
+
+	return &goModuleInfo{name: name, version: version, requestType: requestType}, nil
+}

proxy/interceptors/go_url_parser_test.go

@@ -0,0 +1,132 @@
+package interceptors
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGoProxyParserParseURL(t *testing.T) {
+	cases := []struct {
+		name            string
+		path            string
+		wantName        string
+		wantVersion     string
+		wantType        string
+		wantIsDownload  bool
+		wantErrContains string
+	}{
+		{
+			name:           "zip download",
+			path:           "/github.com/x/y/@v/v1.2.3.zip",
+			wantName:       "github.com/x/y",
+			wantVersion:    "v1.2.3",
+			wantType:       goRequestZip,
+			wantIsDownload: true,
+		},
+		{
+			name:        "info metadata",
+			path:        "/github.com/x/y/@v/v1.2.3.info",
+			wantName:    "github.com/x/y",
+			wantVersion: "v1.2.3",
+			wantType:    goRequestInfo,
+		},
+		{
+			name:        "mod metadata",
+			path:        "/github.com/x/y/@v/v1.2.3.mod",
+			wantName:    "github.com/x/y",
+			wantVersion: "v1.2.3",
+			wantType:    goRequestMod,
+		},
+		{
+			name:     "version list",
+			path:     "/github.com/x/y/@v/list",
+			wantName: "github.com/x/y",
+			wantType: goRequestList,
+		},
+		{
+			name:     "latest metadata",
+			path:     "/github.com/x/y/@latest",
+			wantName: "github.com/x/y",
+			wantType: goRequestLatest,
+		},
+		{
+			name:           "case-escaped module path and version are decoded",
+			path:           "/github.com/!burnt!sushi/toml/@v/!v1.0.0-!rc1.zip",
+			wantName:       "github.com/BurntSushi/toml",
+			wantVersion:    "V1.0.0-Rc1",
+			wantType:       goRequestZip,
+			wantIsDownload: true,
+		},
+		{
+			name:           "pseudo-version",
+			path:           "/example.com/m/@v/v0.0.0-20191109021931-daa7c04131f5.zip",
+			wantName:       "example.com/m",
+			wantVersion:    "v0.0.0-20191109021931-daa7c04131f5",
+			wantType:       goRequestZip,
+			wantIsDownload: true,
+		},
+		{
+			name:           "incompatible version",
+			path:           "/github.com/x/y/@v/v4.1.2+incompatible.zip",
+			wantName:       "github.com/x/y",
+			wantVersion:    "v4.1.2+incompatible",
+			wantType:       goRequestZip,
+			wantIsDownload: true,
+		},
+		{
+			name:     "proxied checksum database traffic",
+			path:     "/sumdb/sum.golang.org/lookup/example.com/m@v1.0.0",
+			wantType: goRequestSumDB,
+		},
+		{
+			name:     "sumdb capability check",
+			path:     "/sumdb/sum.golang.org/supported",
+			wantType: goRequestSumDB,
+		},
+		{
+			name:            "missing marker",
+			path:            "/github.com/x/y",
+			wantErrContains: "missing /@v/",
+		},
+		{
+			name:            "unknown suffix",
+			path:            "/github.com/x/y/@v/v1.2.3.tar",
+			wantErrContains: "unrecognized go proxy version suffix",
+		},
+		{
+			name:            "empty path",
+			path:            "/",
+			wantErrContains: "empty go proxy URL path",
+		},
+		{
+			name:            "version without suffix",
+			path:            "/github.com/x/y/@v/v123",
+			wantErrContains: "no version suffix",
+		},
+	}
+
+	parser := goProxyParser{}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			info, err := parser.ParseURL(tc.path)
+
+			if tc.wantErrContains != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErrContains)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantName, info.GetName())
+			assert.Equal(t, tc.wantVersion, info.GetVersion())
+			assert.Equal(t, tc.wantIsDownload, info.IsFileDownload())
+
+			goInfo, ok := info.(*goModuleInfo)
+			require.True(t, ok)
+			assert.Equal(t, tc.wantType, goInfo.requestType)
+		})
+	}
+}