mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
b19473945b
* feat: add experimental Go module support via pmg go Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command runs solely when invoked explicitly as `pmg go ...` and is deliberately excluded from setup aliases and PATH shims so existing users are unaffected. - packagemanager: goPackageManager with fail-safe command classification (vet/fix excluded from non-download since they can fetch on a cold cache) and pinned-version extraction where only canonical semver counts as explicit. - GOPROXY normalization (fail-closed): effective GOPROXY read via `go env` (honors go env -w), rebuilt comma-joined with `direct` dropped so a 403 block is terminal and nothing silently falls back to unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning; GOINSECURE is cleared. Contributed to the proxy flow through a new ProxyRoutingProvider hook (extra child env + dynamic MITM hosts). - Go interceptor with dynamic host matching from the user's effective GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on .zip only (the sole endpoint that delivers code); .info/.mod/@latest/ list pass through; /sumdb/ traffic and sum.golang.org are never touched so checksum-db verification stays intact; golang.org/toolchain is allowed on Go's own checksum verification. - Dependency cooldown: publish time captured from .info responses (body unmodified), in-window .zip blocked with 403; fails open for cooldown only when the publish time was never observed. - Cert gate: on macOS/Windows `pmg go` fails fast with actionable guidance unless the persisted PMG CA is OS-trusted (Go ignores SSL_CERT_FILE there); Linux works via the injected bundle. - proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic cases (allow/block/confirm, case-escaped paths, cooldown block and fail-open, toolchain, sumdb passthrough). Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0` MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch, and go.sum verification succeeds through the tunneled checksum db. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * fix(go): address review findings on experimental Go support - Drop fmt/clean from NonDownloadCommands: both load packages via go list and can download modules on a cold cache, which would bypass the proxy under install_only. - Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at https://corp/goproxy): the interceptor now receives host -> base URL and strips the path prefix before parsing module URLs, so verdicts and cooldown key on the real module path. - Default unschemed GOPROXY entries to https, matching go's own behavior, so corp mirrors configured as bare hosts are intercepted instead of silently unanalyzed. - Memoize the final verdict per module zip: go re-requests a failed zip during go get's load phase, which double-recorded stats (the report showed the same blocked module twice) and would have re-prompted on Confirm verdicts. - Fetch .info out-of-band on a cooldown cache miss: go serves .info from its local module cache on any machine that used go before PMG, which silently disabled cooldown. Failure of the side-fetch still fails open for cooldown only. - Move the noop package resolver into packagemanager. Verified live: cold-cache cooldown block now records once; warm-cache rerun is blocked via the side-fetch instead of failing open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * docs: collapse Go proxy-mode details by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK --------- Co-authored-by: Claude <noreply@anthropic.com>
98 lines
4.3 KiB
AMPL
98 lines
4.3 KiB
AMPL
module github.com/safedep/pmg
|
|
|
|
go 1.25.1
|
|
|
|
require (
|
|
buf.build/gen/go/safedep/api/grpc/go v1.6.2-20260528074646-b9e182189444.1
|
|
buf.build/gen/go/safedep/api/protocolbuffers/go v1.36.11-20260620084912-77c7bb923ddb.1
|
|
github.com/Masterminds/semver v1.5.0
|
|
github.com/elazarl/goproxy v1.8.1
|
|
github.com/fatih/color v1.18.0
|
|
github.com/goccy/go-yaml v1.19.2
|
|
github.com/gofrs/flock v0.13.0
|
|
github.com/google/osv-scalibr v0.2.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/jedib0t/go-pretty/v6 v6.7.9
|
|
github.com/landlock-lsm/go-landlock v0.7.0
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
|
|
github.com/posthog/posthog-go v1.5.12
|
|
github.com/safedep/dry v0.0.0-20260620130340-2af76e505537
|
|
github.com/safedep/ptyx v0.2.1-0.20260529140457-d1f745842a6a
|
|
github.com/sony/gobreaker/v2 v2.4.0
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/mod v0.33.0
|
|
golang.org/x/net v0.51.0
|
|
golang.org/x/sync v0.20.0
|
|
golang.org/x/sys v0.43.0
|
|
golang.org/x/term v0.42.0
|
|
google.golang.org/grpc v1.81.0
|
|
google.golang.org/protobuf v1.36.11
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
al.essio.dev/pkg/shellescape v1.5.1 // indirect
|
|
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
|
|
github.com/BurntSushi/toml v1.5.0 // indirect
|
|
github.com/Masterminds/semver/v3 v3.3.1 // indirect
|
|
github.com/caarlos0/env/v11 v11.3.1 // indirect
|
|
github.com/clipperhouse/stringish v0.1.1 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
|
|
github.com/danieljoos/wincred v1.2.2 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/denisbrodbeck/machineid v1.0.1 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-git/go-billy/v5 v5.6.2 // indirect
|
|
github.com/go-git/go-git/v5 v5.14.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.30.2 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
|
|
github.com/gobwas/glob v0.2.3 // indirect
|
|
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/go-github/v74 v74.0.0 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.19 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/oklog/ulid/v2 v2.1.1 // indirect
|
|
github.com/package-url/packageurl-go v0.1.3 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/sagikazarmark/locafero v0.11.0 // indirect
|
|
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/tidwall/jsonc v0.3.2 // indirect
|
|
github.com/zalando/go-keyring v0.2.6 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.49.0 // indirect
|
|
golang.org/x/text v0.35.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect
|
|
modernc.org/libc v1.70.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
modernc.org/sqlite v1.48.1 // indirect
|
|
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
)
|