mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
2d938ea381
* docs(specs): add custom block messages and package blocklist spec * docs(specs): add custom block messages and package blocklist implementation plan * feat(config): add blocked_packages list and custom block messages * feat(audit): add package_blocklist_blocked event and blocklist model * feat(proxy): block blocklisted packages in the policy gate before analysis * feat(guard): block blocklisted packages before trust skip and analysis * feat(ui): render blocklist blocks and custom messages, fix silent-mode block output * feat(proxy): append custom messages to malware and go-cooldown block bodies * test(proxye2e): cover blocklist enforcement and custom block messages * docs(specs): remove spec and plan documents * refactor: drop guard-flow blocklist enforcement and trim docs Guard mode is being deprecated; the blocklist is enforced in proxy mode only. Remove the trusted_packages mirroring references outside the docs. * refactor(config): consolidate blocklist and block message under top-level block section Replace dependency_cooldown.message, malware.message and blocked_packages with a single block section: block.message is appended to every block output regardless of which control blocked, and block.packages is the package blocklist. * fix(ui): render block.message as info note with clean spacing * fix(ui): indent wrapped continuation lines in block reasons and messages * update config template * refactor(config): replace block section with top-level advisory_message Remove the package blocklist (will be implemented as part of policies in the future) and replace block.message with an optional top-level advisory_message appended to every block output. * chore(config): move advisory_message near top-level scalar configs in template
50 lines
1.2 KiB
Go
50 lines
1.2 KiB
Go
package config
|
|
|
|
import (
|
|
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
|
|
"github.com/safedep/dry/api/pb"
|
|
"github.com/safedep/dry/log"
|
|
)
|
|
|
|
// purlRef is the pre-parsed form of a PURL list entry (trusted_packages,
|
|
// dependency_cooldown.skip). Parsing happens once at config load; entries
|
|
// with an invalid PURL are marked unparsed and never match.
|
|
type purlRef struct {
|
|
parsed bool
|
|
ecosystem packagev1.Ecosystem
|
|
name string
|
|
version string
|
|
}
|
|
|
|
func (r *purlRef) parseFrom(purl string) {
|
|
parsedPurl, err := pb.NewPurlPackageVersion(purl)
|
|
if err != nil {
|
|
log.Warnf("Failed to parse package PURL: %s: %v", purl, err)
|
|
r.parsed = false
|
|
return
|
|
}
|
|
|
|
r.parsed = true
|
|
r.ecosystem = parsedPurl.Ecosystem()
|
|
r.name = parsedPurl.Name()
|
|
r.version = parsedPurl.Version()
|
|
}
|
|
|
|
// matches reports whether the ref matches a package version. A version-less
|
|
// ref matches every version of the package.
|
|
func (r purlRef) matches(pv *packagev1.PackageVersion) bool {
|
|
if !r.parsed || pv == nil {
|
|
return false
|
|
}
|
|
if r.ecosystem != pv.GetPackage().GetEcosystem() {
|
|
return false
|
|
}
|
|
if r.name != pv.GetPackage().GetName() {
|
|
return false
|
|
}
|
|
if r.version != "" && r.version != pv.GetVersion() {
|
|
return false
|
|
}
|
|
return true
|
|
}
|