mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
20c854e473
* introduce a persistent config * add tests and refactor config creation * update config handling and add support for removing config * add support to skip suspicious pkgs marked as trusted * add support for config dir Env & unexport functions * small fixes * add assert for dir * fix tests * fix shell source line & trusted pkgs parsing * fix flag inconsistency * update config to read on each invocation and create if does not exist * fix flags value being overridden * remove redundant func call * modify trusted pkg check to be config bound * modify RemoveConfig to rm files & not dir. add tests for paths.go * add versions for package for e2e * modify tests to reset config * fix: Simplify config persistence * fix: Misc comments * fix: Misc fix * fix: Do not overwrite config file if exists * fix: Do not overwrite config file if exists * fix: Config cobra command should override and not replace * fix: Create dir before writing config template * fix: Create dir before writing config template * fix: Misc refactoring * test: Add test for is trusted package version * Update cmd/setup/setup.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * Update config/config.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * fix: Remove unused constant in config * fix: Resolve conflict with event logger * docs: Add doc for eventlogger.Logger interface * test: Add E2E for config file creation * fix: Code review fixes --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Sahilb315 <bansalsahil315@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
# PMG configuration template. Customize this file as needed.
|
|
# https://github.com/safedep/pmg
|
|
|
|
# Enable transitive dependency resolution. Default is true.
|
|
transitive: true
|
|
|
|
# Maximum depth of transitive dependencies to resolve. Default is 5.
|
|
transitive_depth: 5
|
|
|
|
# Include dev dependencies in the dependency graph. Default is false.
|
|
include_dev_dependencies: false
|
|
|
|
# Enable paranoid mode. In paranoid mode, PMG will use SafeDep Cloud credentials
|
|
# to scan unknown packages for malware. This is slow and should be used with caution.
|
|
paranoid: false
|
|
|
|
# Skip event logging. Default is false.
|
|
# When event logging is enabled, all events will be logged to file. These events are useful for audit
|
|
# trail and incident response on systems using PMG. Set this config to true to skip event logging.
|
|
skip_event_logging: false
|
|
|
|
# Event log retention days. Default is 7.
|
|
# This is the number of days to retain event logs.
|
|
event_log_retention_days: 7
|
|
|
|
# Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
|
|
# This is useful for packages that are known to be safe and are used in the application.
|
|
# Example:
|
|
# - purl: pkg:npm/@safedep/pmg
|
|
# reason: "PMG is a trusted package for PMG"
|
|
#
|
|
# When a package is specified without an explicit version, all versions of the package will be trusted.
|
|
# This feature should be used with caution and should be used for minimal set of packages.
|
|
#
|
|
# When a package is specified with an explicit version, only that version will be trusted.
|
|
#
|
|
# The purl is the package identifier and the reason is the reason for trusting the package.
|
|
# PURL specification: https://github.com/package-url/purl-spec
|
|
trusted_packages:
|
|
- purl: pkg:npm/@safedep/pmg
|
|
reason: "PMG is a trusted package for PMG"
|
|
|