mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
648adcbda4
* feat(uvx): add uvx (uv tool run) package executor Adds support for `uvx`, implemented as a PyPI Executor alongside pipx. uvx is an alias for `uv tool run`: it installs a tool into an ephemeral environment and runs it, so it has no install/list subcommand and the first positional argument (or --from) is the package to audit. Parsing highlights: - --from overrides the positional command as the package to audit - --with packages are audited as additional environment dependencies - name@version shorthand (ruff@0.3.0, ruff@latest) is normalized - flag parsing stops at the tool name so the tool's own flags are not misread as uvx options; uvx's value/boolean flags are registered so none greedily consume the package positional - VCS/URL/local-path specs are skipped for registry auditing Wires up command registration, analytics, shell alias/shim, cloud audit mapping, a dedicated `uvx` sandbox profile (UV_*/PIP_* env, uv cache and tool dirs), config policy, docs, unit tests and an E2E workflow step. Closes #326 https://claude.ai/code/session_011hyLxq7oWJX5Dp4tCEfG19 * chore(uvx): align docs and base profile with uvx support Incorporates the low-risk, non-parser improvements from the community PR #345 (author non-responsive) into our implementation: - list uvx (and the previously-missing pipx) as PyPI managers in the pypi-restrictive base profile package_managers and its README, so the base profile applies directly when selected via --sandbox-profile - document uvx in docs/github-action.md and docs/proxy-mode.md - add version / IsExplicitVersion assertions to the uvx parser tests Our pflag-based parser is kept as-is: unlike #345 it audits --with packages and handles all uvx short flags (e.g. -w), both of which the community PR misses. * fix(uvx): skip interpreter requests; use require in tests Addresses review feedback on PR #357: - uvx interpreter requests (`uvx python`, `uvx python@3.12`, `uvx pypy`, ...) launch an isolated interpreter rather than installing a PyPI tool. Treating the positional as a package made the guard flow resolve/analyze pkg:pypi/python (and python==3.12), which could wrongly block or fail a valid invocation. Skip these for the positional; --with packages on the same command are still audited. - Use require.NoError / require.Len for fatal assertions in the uvx tests, matching the repo's testing convention, so a failure stops the subtest before a nil dereference instead of panicking. * docs(uvx): document fail-open and --with-requirements trade-offs Record the two deliberate parsing decisions raised in review as in-code trade-off comments (no behavior change): - unknown flags are tolerated (fail open), consistent with the other executors; the residual gap only affects non-proxy guard mode since the default proxy flow intercepts every registry download. - --with-requirements / --with-editable values are consumed but not expanded into audit targets; expanding them needs manifest-extractor and guard changes, tracked as follow-up. Proxy mode still covers them. * docs(uvx): drop --with-requirements limitation note Per maintainer review: guard mode is being deprecated and auditing the contents of an existing requirements file is a scanner's responsibility, not PMG's. Remove the "known limitation / follow-up" note; the flags stay registered only so their values are not mistaken for the tool positional. --------- Co-authored-by: Claude <noreply@anthropic.com>
100 lines
3.0 KiB
YAML
100 lines
3.0 KiB
YAML
name: pypi-restrictive
|
|
description: Restrictive sandbox policy for PyPI ecosystem (pip, poetry, uv)
|
|
package_managers:
|
|
- pip
|
|
- pip3
|
|
- pipx
|
|
- poetry
|
|
- uv
|
|
- uvx
|
|
|
|
# Optional security settings (uncomment to enable)
|
|
# allow_git_config: false # Allow package managers to modify .git/config (default: false, blocks for security)
|
|
|
|
# Allow interactive terminal (PTY) operations (default: false)
|
|
allow_pty: true
|
|
|
|
filesystem:
|
|
allow_read:
|
|
# Root read is required for shims (e.g., asdf, pyenv) that traverse the filesystem.
|
|
# This is safe because deny rules have higher precedence and dangerous files
|
|
# (.env, .ssh, .aws, .gnupg, etc.) are blocked by mandatory deny patterns.
|
|
- /
|
|
- ${CWD}/**
|
|
- ${HOME}/.config/pip/**
|
|
- ${HOME}/.pip/**
|
|
- ${HOME}/.poetry/**
|
|
- ${HOME}/.cache/pip/**
|
|
- ${HOME}/.cache/pypoetry/**
|
|
- ${HOME}/.cache/poetry/**
|
|
- ${HOME}/.cache/uv/**
|
|
- /usr/local/**
|
|
- /Library/**
|
|
- /System/Library/**
|
|
|
|
allow_write:
|
|
# Note: ${TMPDIR} is automatically allowed when write restrictions are enabled (macOS)
|
|
# Note: Patterns ending with /** automatically allow creating the parent directory.
|
|
# For example, ${CWD}/.venv/** allows both:
|
|
# 1. Creating the .venv directory itself
|
|
# 2. Writing any files/directories inside it
|
|
# Temporary directories for shell scripts and package managers
|
|
# Note: On macOS, /tmp is a symlink to /private/tmp, so we need both
|
|
- /tmp/**
|
|
- /private/tmp/**
|
|
- /var/tmp/**
|
|
- ${CWD}/.venv/**
|
|
- ${CWD}/venv/**
|
|
- ${HOME}/.cache/pip/**
|
|
- ${HOME}/.cache/pypoetry/**
|
|
- ${HOME}/.cache/poetry/**
|
|
- ${HOME}/.cache/uv/**
|
|
- ${HOME}/Library/Caches/pip/**
|
|
- ${HOME}/.local/lib/python*/**
|
|
|
|
# Additional deny rules (optional - credentials are automatically blocked)
|
|
# Automatically blocked for security:
|
|
# - .env, .env.*, .ssh/, .aws/, .gcloud/, .kube/, .gnupg/, .docker/config.json
|
|
# - .git/hooks/ (always blocked)
|
|
# - .git/config (blocked unless allow_git_config: true)
|
|
deny_read: []
|
|
|
|
deny_write:
|
|
# Additional system directories to protect
|
|
- /etc/**
|
|
- /usr/**
|
|
|
|
network:
|
|
allow_outbound:
|
|
- pypi.org:443
|
|
- files.pythonhosted.org:443
|
|
- github.com:443
|
|
|
|
deny_outbound:
|
|
- "*:*"
|
|
|
|
environment:
|
|
# This profile is the shared base for the PyPI ecosystem and deliberately
|
|
# allows no environment variables: everything in the built-in
|
|
# DANGEROUS_ENV_VARS list is scrubbed. Each package manager's leaf profile
|
|
# (pip, uv, poetry) re-allows only the variables that package manager needs.
|
|
# TWINE_* is allowed nowhere: twine is not a package manager PMG wraps, so
|
|
# its publishing credentials stay scrubbed during installs.
|
|
allow: []
|
|
|
|
process:
|
|
allow_exec:
|
|
- /usr/bin/python*
|
|
- /usr/local/bin/python*
|
|
- /usr/bin/gcc
|
|
- /usr/bin/clang
|
|
- /usr/bin/git
|
|
# Required for shims (e.g., asdf) that use #!/usr/bin/env bash
|
|
- /bin/bash
|
|
- /bin/sh
|
|
- /usr/bin/env
|
|
|
|
deny_exec:
|
|
- /usr/bin/curl
|
|
- /usr/bin/wget
|