mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahilb315
d987512ccf
Redirecting a package manager into the proxy is only half the job. The client then has to trust the proxy's certificate, and npm will not, because Node from nodejs.org compiles its own roots into the binary and ignores the system trust store. Adds `pmgwatch ca` with install, status and remove. install persists a CA keypair through PMG's own certmanager, so the certificate survives a proxy restart. Without a persisted CA the daemon generates an ephemeral one on every start and trust has to be redone each time. The private key is left owned by the proxy user at 0600, and a separate public bundle is written for npm, so npm never needs access to the key. npm is configured through `npm config set cafile --location=user`, run as the target user. Environment variables that could shadow that config are stripped from the child so the read-back verification is meaningful. The previous cafile is recorded and restored on remove. install refuses to run while the proxy is up, since the daemon reads the certificate at startup, and refuses to change options against existing state so a half-migrated setup cannot happen.
19 lines
437 B
AMPL
19 lines
437 B
AMPL
module ebpf-poc
|
|
|
|
go 1.25.1
|
|
|
|
require github.com/cilium/ebpf v0.22.0
|
|
|
|
require (
|
|
github.com/safedep/dry v0.0.0-20260716095238-84cd2b3cd3a4 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.43.0 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
)
|
|
|
|
require github.com/safedep/pmg v0.0.0
|
|
|
|
replace github.com/safedep/pmg => ..
|