Add experimental Go module proxy support (#358)

* feat: add experimental Go module support via pmg go Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command runs solely when invoked explicitly as `pmg go ...` and is deliberately excluded from setup aliases and PATH shims so existing users are unaffected. - packagemanager: goPackageManager with fail-safe command classification (vet/fix excluded from non-download since they can fetch on a cold cache) and pinned-version extraction where only canonical semver counts as explicit. - GOPROXY normalization (fail-closed): effective GOPROXY read via `go env` (honors go env -w), rebuilt comma-joined with `direct` dropped so a 403 block is terminal and nothing silently falls back to unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning; GOINSECURE is cleared. Contributed to the proxy flow through a new ProxyRoutingProvider hook (extra child env + dynamic MITM hosts). - Go interceptor with dynamic host matching from the user's effective GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on .zip only (the sole endpoint that delivers code); .info/.mod/@latest/ list pass through; /sumdb/ traffic and sum.golang.org are never touched so checksum-db verification stays intact; golang.org/toolchain is allowed on Go's own checksum verification. - Dependency cooldown: publish time captured from .info responses (body unmodified), in-window .zip blocked with 403; fails open for cooldown only when the publish time was never observed. - Cert gate: on macOS/Windows `pmg go` fails fast with actionable guidance unless the persisted PMG CA is OS-trusted (Go ignores SSL_CERT_FILE there); Linux works via the injected bundle. - proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic cases (allow/block/confirm, case-escaped paths, cooldown block and fail-open, toolchain, sumdb passthrough). Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0` MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch, and go.sum verification succeeds through the tunneled checksum db. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * fix(go): address review findings on experimental Go support - Drop fmt/clean from NonDownloadCommands: both load packages via go list and can download modules on a cold cache, which would bypass the proxy under install_only. - Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at https://corp/goproxy): the interceptor now receives host -> base URL and strips the path prefix before parsing module URLs, so verdicts and cooldown key on the real module path. - Default unschemed GOPROXY entries to https, matching go's own behavior, so corp mirrors configured as bare hosts are intercepted instead of silently unanalyzed. - Memoize the final verdict per module zip: go re-requests a failed zip during go get's load phase, which double-recorded stats (the report showed the same blocked module twice) and would have re-prompted on Confirm verdicts. - Fetch .info out-of-band on a cooldown cache miss: go serves .info from its local module cache on any machine that used go before PMG, which silently disabled cooldown. Failure of the side-fetch still fails open for cooldown only. - Move the noop package resolver into packagemanager. Verified live: cold-cache cooldown block now records once; warm-cache rerun is blocked via the side-fetch instead of failing open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * docs: collapse Go proxy-mode details by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-08-03 07:24:09 +02:00 · 2026-07-03 18:19:31 +05:30
parent 648adcbda4
commit b19473945b
24 changed files with 1941 additions and 15 deletions
@@ -0,0 +1,205 @@
+package interceptors
+
+import (
+	"net/url"
+	"strings"
+	"sync"
+
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/analyzer"
+	pmgconfig "github.com/safedep/pmg/config"
+	"github.com/safedep/pmg/proxy"
+)
+
+// goToolchainModule is the module path Go uses to auto-download toolchains
+// (GOTOOLCHAIN=auto). Toolchain zips are verified by go against the checksum
+// database regardless of GOPRIVATE/GONOSUMDB, and downloads fail closed when
+// GOSUMDB=off, so PMG passes them through on Go's own verification instead of
+// treating them as ordinary (never-flagged) modules.
+const goToolchainModule = "golang.org/toolchain"
+
+// GoRegistryInterceptor intercepts Go module proxy requests and analyzes
+// module zips for malware. Unlike npm/PyPI, the registry hosts are not fixed:
+// they come from the user's effective GOPROXY via
+// InterceptorContext.GoProxyBaseURLs. sum.golang.org is never in that set, so
+// checksum-database traffic is tunneled, not MITM'd.
+type GoRegistryInterceptor struct {
+	baseRegistryInterceptor
+	domains         registryConfigMap
+	baseURLs        map[string]string
+	cooldownHandler *goCooldownHandler
+
+	// zipVerdicts memoizes the final response per module zip. go re-requests
+	// a failed zip (once more during go get's load phase), and without this
+	// the repeat would double-record stats — the report would show the same
+	// blocked module twice — and re-prompt the user on a Confirm verdict.
+	zipVerdictsMu sync.Mutex
+	zipVerdicts   map[string]*proxy.InterceptorResponse
+}
+
+var _ proxy.Interceptor = (*GoRegistryInterceptor)(nil)
+var _ proxy.MITMDecider = (*GoRegistryInterceptor)(nil)
+
+func NewGoRegistryInterceptor(
+	analyzer analyzer.PackageVersionAnalyzer,
+	cache AnalysisCache,
+	statsCollector *AnalysisStatsCollector,
+	confirmationChan chan *ConfirmationRequest,
+	execContext InterceptorContext,
+) *GoRegistryInterceptor {
+	domains := registryConfigMap{}
+	baseURLs := map[string]string{}
+	for host, baseURL := range execContext.GoProxyBaseURLs {
+		basePath := ""
+		if u, err := url.Parse(baseURL); err == nil {
+			basePath = strings.TrimSuffix(u.Path, "/")
+		}
+
+		domains[host] = &registryConfig{
+			Host:                 host,
+			SupportedForAnalysis: true,
+			Parser:               goProxyParser{basePath: basePath},
+		}
+		baseURLs[host] = baseURL
+	}
+
+	return &GoRegistryInterceptor{
+		baseRegistryInterceptor: baseRegistryInterceptor{
+			analyzer:         analyzer,
+			cache:            cache,
+			statsCollector:   statsCollector,
+			confirmationChan: confirmationChan,
+			circuitBreaker:   newAnalyzerCircuitBreaker("malysis-analyzer-go"),
+			execContext:      execContext,
+		},
+		domains:         domains,
+		baseURLs:        baseURLs,
+		cooldownHandler: newGoCooldownHandler(statsCollector),
+		zipVerdicts:     map[string]*proxy.InterceptorResponse{},
+	}
+}
+
+func (i *GoRegistryInterceptor) Name() string {
+	return "go-registry-interceptor"
+}
+
+func (i *GoRegistryInterceptor) ShouldMITM(ctx *proxy.RequestContext) bool {
+	config := i.domains.GetConfigForHostname(ctx.Hostname)
+	if config == nil {
+		return false
+	}
+
+	return config.SupportedForAnalysis
+}
+
+func (i *GoRegistryInterceptor) ShouldIntercept(ctx *proxy.RequestContext) bool {
+	return i.domains.ContainsHostname(ctx.Hostname)
+}
+
+// HandleRequest processes the request and returns response action.
+// We take a fail-open approach here, allowing requests that we can't parse the
+// package information from the URL — but an unparseable .zip means an
+// unanalyzed source download, so that case is logged loudly.
+func (i *GoRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*proxy.InterceptorResponse, error) {
+	log.Debugf("[%s] Handling Go module proxy request: %s", ctx.RequestID, ctx.URL.Path)
+
+	config := i.domains.GetConfigForHostname(ctx.Hostname)
+	if config == nil {
+		log.Warnf("[%s] No registry config found for hostname: %s", ctx.RequestID, ctx.Hostname)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	pkgInfo, err := config.Parser.ParseURL(ctx.URL.Path)
+	if err != nil {
+		if strings.HasSuffix(ctx.URL.Path, ".zip") {
+			log.Warnf("[%s] Failed to parse Go module proxy zip URL %s: %v — download allowed without analysis",
+				ctx.RequestID, ctx.URL.Path, err)
+		} else {
+			log.Debugf("[%s] Failed to parse Go module proxy URL %s: %v", ctx.RequestID, ctx.URL.Path, err)
+		}
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	info, ok := pkgInfo.(*goModuleInfo)
+	if !ok {
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	if info.requestType == goRequestSumDB {
+		log.Debugf("[%s] Allowing proxied checksum-database request: %s", ctx.RequestID, ctx.URL.Path)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	if info.name == goToolchainModule {
+		if info.IsFileDownload() {
+			log.Infof("[%s] Allowing Go toolchain download %s@%s (verified by Go's checksum database)",
+				ctx.RequestID, info.name, info.version)
+		}
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	depCooldownConfig := pmgconfig.Get().Config.DependencyCooldown
+
+	if !info.IsFileDownload() {
+		if info.requestType == goRequestInfo && info.version != "" && depCooldownConfig.Enabled {
+			return i.cooldownHandler.HandleInfoRequest(ctx, info.name, info.version)
+		}
+
+		log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, info.name)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
+	}
+
+	key := goModuleVersionKey(info.name, info.version)
+
+	i.zipVerdictsMu.Lock()
+	memo := i.zipVerdicts[key]
+	i.zipVerdictsMu.Unlock()
+	if memo != nil {
+		log.Debugf("[%s] Reusing verdict for repeated zip request: %s", ctx.RequestID, key)
+		return memo, nil
+	}
+
+	resp, memoize, err := i.handleZipDownload(ctx, config, info, depCooldownConfig)
+	if err != nil {
+		return resp, err
+	}
+
+	if memoize {
+		i.zipVerdictsMu.Lock()
+		i.zipVerdicts[key] = resp
+		i.zipVerdictsMu.Unlock()
+	}
+
+	return resp, nil
+}
+
+// handleZipDownload runs the security controls for a module source download:
+// dependency cooldown, then trusted/insecure fast-allow, then malware
+// analysis. memoize is false only when the outcome is a fail-open allow after
+// an analyzer error, so a retried request gets another chance to be analyzed.
+func (i *GoRegistryInterceptor) handleZipDownload(
+	ctx *proxy.RequestContext,
+	config *registryConfig,
+	info *goModuleInfo,
+	depCooldownConfig pmgconfig.DependencyCooldownConfig,
+) (*proxy.InterceptorResponse, bool, error) {
+	if depCooldownConfig.Enabled {
+		if resp, handled := i.cooldownHandler.CheckZipDownload(ctx, i.baseURLs[config.Host], info.name, info.version, depCooldownConfig.Days); handled {
+			return resp, true, nil
+		}
+	}
+
+	if resp, ok := i.fastAllow(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version); ok {
+		return resp, true, nil
+	}
+
+	result, err := i.analyzePackage(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version)
+	if err != nil {
+		log.Errorf("[%s] Failed to analyze package %s@%s: %v", ctx.RequestID, info.name, info.version, err)
+		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, false, nil
+	}
+
+	resp, err := i.handleAnalysisResult(ctx, packagev1.Ecosystem_ECOSYSTEM_GO, info.name, info.version, result)
+	return resp, err == nil, err
+}