mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
327c9c7068
* feat(cooldown): respect trusted_packages in dependency cooldown Trusted packages are now treated as a superset waiver that bypasses every PMG control (malware analysis, cooldown, and any future controls). A globally trusted package is automatically exempt from the cooldown window and no longer needs a duplicate entry in dependency_cooldown.skip. The skip list remains the narrower, cooldown-only waiver for packages that must bypass the cooldown wait but still be malware-scanned. * refactor(cooldown): tag skip reason and audit-log skipped packages Address review feedback on #342: - Restore cooldownSkip to a pure single-list function (SRP); the merge into trusted_packages now happens in a separate mergeCooldownSkip step, driven by the exported CooldownSkip wrapper. - Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage / CooldownSkipList) on both SkipAll and per-version entries, so callers can tell apart the broad waiver from the cooldown-only one. When both lists match the same package, trusted_packages wins. - Add audit.LogCooldownSkipped and emit it from the npm and PyPI interceptors on the SkipAll path, alongside the existing info log, carrying the source list as the reason. * refactor(cooldown): inline list merge, audit per-version exemptions Address further review feedback: - Drop the separate mergeCooldownSkip helper; cooldownSkip now writes into a shared *CooldownSkipInfo and is called twice from CooldownSkip (cooldown skip list first, trusted_packages on top so trusted entries override the reason on overlap). - Audit log every exemption, not just SkipAll: a new auditCooldownSkip helper in proxy/interceptors/cooldown.go emits one event per match (package-wide or per-version), each tagged with its source list. LogCooldownSkipped gains a version argument for the per-version case. - Cover the trusted_packages reason path in TestCooldownSkip. * fix(cooldown): avoid double-auditing trusted package exemptions auditCooldownSkip now only emits EventTypeCooldownSkipped for entries that came from dependency_cooldown.skip. Trusted-package exemptions already get an EventTypeInstallTrustedAllowed event at tarball-download time (proxy/interceptors/base_registry.go), so emitting a cooldown event for them too would double-count the same waiver. * emit trusted and cooldown skip events to cloud * fix tests * refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll Address PR review feedback: - Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo instead of mutating an input pointer. - Add mergeCooldownSkip to combine per-list results with trusted_packages taking precedence on overlap. - CooldownSkip now consults trusted_packages first and returns immediately on a package-wide trusted exemption (DC skip list cannot add anything). - Extend tests to cover disjoint pinned entries across both lists and the case where DC version-less subsumes a trusted pinned entry. * fix(audit): address cooldown review feedback * fix(cooldown): audit cooldown skips at download time with concrete version Backend rejects PackageVersion messages without a version, and audit logs should reflect the runtime fact (a specific version was skipped) rather than the config rule. Move the audit emission from metadata-request handling to download-request handling, where the concrete version is known, and require version in LogCooldownSkipped. * chore(audit): drop dead scope assignment in LogCooldownSkipped * refactor(cooldown): move skip-list logic into cooldown handlers Registry interceptors no longer compute CooldownSkip or branch on SkipAll; they just call HandleMetadataRequest. The npm and pypi cooldown handlers own the skip lookup, the package-wide exemption short-circuit, and (for pypi) the canonical-name denormalization. Also align LogCooldownSkipped with other LogXxx signatures by taking *packagev1.PackageVersion. * fix: Simplify audit logging for dependency cooldown skip * refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages * fix: Code review fixes * fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped --------- Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
84 lines
2.4 KiB
Go
84 lines
2.4 KiB
Go
package audit
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/safedep/pmg/internal/eventlog"
|
|
)
|
|
|
|
type eventlogSink struct{}
|
|
|
|
func newEventlogSink() *eventlogSink {
|
|
return &eventlogSink{}
|
|
}
|
|
|
|
func (s *eventlogSink) Handle(_ context.Context, event AuditEvent) error {
|
|
details := event.Details
|
|
if details == nil && event.SessionData != nil {
|
|
details = sessionDataToDetails(event.SessionData)
|
|
}
|
|
|
|
elEvent := eventlog.Event{
|
|
Timestamp: event.Timestamp,
|
|
EventType: mapEventType(event.Type),
|
|
Message: event.Message,
|
|
PackageName: pkgName(event.PackageVersion),
|
|
Version: pkgVersion(event.PackageVersion),
|
|
Ecosystem: pkgEcosystem(event.PackageVersion),
|
|
Details: details,
|
|
}
|
|
return eventlog.LogEvent(elEvent)
|
|
}
|
|
|
|
func sessionDataToDetails(sd *SessionData) map[string]interface{} {
|
|
return map[string]interface{}{
|
|
"outcome": sd.Outcome,
|
|
"flow_type": sd.FlowType,
|
|
"package_manager": sd.PackageManager,
|
|
"total_analyzed": sd.TotalAnalyzed,
|
|
"allowed_count": sd.AllowedCount,
|
|
"blocked_count": sd.BlockedCount,
|
|
"confirmed_count": sd.ConfirmedCount,
|
|
"trusted_skipped": sd.TrustedSkipped,
|
|
"insecure_bypassed": sd.InsecureBypassed,
|
|
"cooldown_blocked_count": sd.CooldownBlockedCount,
|
|
}
|
|
}
|
|
|
|
func (s *eventlogSink) Close() error {
|
|
return nil
|
|
}
|
|
|
|
func mapEventType(t EventType) eventlog.EventType {
|
|
switch t {
|
|
case EventTypeMalwareBlocked:
|
|
return eventlog.EventTypeMalwareBlocked
|
|
case EventTypeMalwareConfirmed:
|
|
return eventlog.EventTypeMalwareConfirmed
|
|
case EventTypeInstallAllowed:
|
|
return eventlog.EventTypeInstallAllowed
|
|
case EventTypeInstallTrustedAllowed:
|
|
return eventlog.EventTypeInstallTrustedAllowed
|
|
case EventTypeInstallStarted:
|
|
return eventlog.EventTypeInstallStarted
|
|
case EventTypeDependencyResolved:
|
|
return eventlog.EventTypeDependencyResolved
|
|
case EventTypeInstallInsecureBypass:
|
|
return eventlog.EventTypeInstallInsecureBypass
|
|
case EventTypeProxyHostObserved:
|
|
return eventlog.EventTypeProxyHostObserved
|
|
case EventTypeDependencyCooldown:
|
|
return eventlog.EventTypeDependencyCooldown
|
|
case EventTypeCooldownSkipped:
|
|
return eventlog.EventTypeCooldownSkipped
|
|
case EventTypeSandboxOverride:
|
|
return eventlog.EventTypeSandboxOverride
|
|
case EventTypeError:
|
|
return eventlog.EventTypeError
|
|
case EventTypeSessionComplete:
|
|
return eventlog.EventType("session_complete")
|
|
default:
|
|
return eventlog.EventType(string(t))
|
|
}
|
|
}
|