mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
b19473945b
* feat: add experimental Go module support via pmg go Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command runs solely when invoked explicitly as `pmg go ...` and is deliberately excluded from setup aliases and PATH shims so existing users are unaffected. - packagemanager: goPackageManager with fail-safe command classification (vet/fix excluded from non-download since they can fetch on a cold cache) and pinned-version extraction where only canonical semver counts as explicit. - GOPROXY normalization (fail-closed): effective GOPROXY read via `go env` (honors go env -w), rebuilt comma-joined with `direct` dropped so a 403 block is terminal and nothing silently falls back to unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning; GOINSECURE is cleared. Contributed to the proxy flow through a new ProxyRoutingProvider hook (extra child env + dynamic MITM hosts). - Go interceptor with dynamic host matching from the user's effective GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on .zip only (the sole endpoint that delivers code); .info/.mod/@latest/ list pass through; /sumdb/ traffic and sum.golang.org are never touched so checksum-db verification stays intact; golang.org/toolchain is allowed on Go's own checksum verification. - Dependency cooldown: publish time captured from .info responses (body unmodified), in-window .zip blocked with 403; fails open for cooldown only when the publish time was never observed. - Cert gate: on macOS/Windows `pmg go` fails fast with actionable guidance unless the persisted PMG CA is OS-trusted (Go ignores SSL_CERT_FILE there); Linux works via the injected bundle. - proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic cases (allow/block/confirm, case-escaped paths, cooldown block and fail-open, toolchain, sumdb passthrough). Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0` MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch, and go.sum verification succeeds through the tunneled checksum db. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * fix(go): address review findings on experimental Go support - Drop fmt/clean from NonDownloadCommands: both load packages via go list and can download modules on a cold cache, which would bypass the proxy under install_only. - Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at https://corp/goproxy): the interceptor now receives host -> base URL and strips the path prefix before parsing module URLs, so verdicts and cooldown key on the real module path. - Default unschemed GOPROXY entries to https, matching go's own behavior, so corp mirrors configured as bare hosts are intercepted instead of silently unanalyzed. - Memoize the final verdict per module zip: go re-requests a failed zip during go get's load phase, which double-recorded stats (the report showed the same blocked module twice) and would have re-prompted on Confirm verdicts. - Fetch .info out-of-band on a cooldown cache miss: go serves .info from its local module cache on any machine that used go before PMG, which silently disabled cooldown. Failure of the side-fetch still fails open for cooldown only. - Move the noop package resolver into packagemanager. Verified live: cold-cache cooldown block now records once; warm-cache rerun is blocked via the side-fetch instead of failing open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * docs: collapse Go proxy-mode details by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK --------- Co-authored-by: Claude <noreply@anthropic.com>
92 lines
1.8 KiB
Go
92 lines
1.8 KiB
Go
package analytics
|
|
|
|
const (
|
|
eventRun = "pmg_command_run"
|
|
eventCommandNpm = "pmg_command_npm"
|
|
eventCommandBun = "pmg_command_bun"
|
|
eventCommandPnpm = "pmg_command_pnpm"
|
|
eventCommandYarn = "pmg_command_yarn"
|
|
eventCommandPip = "pmg_command_pip"
|
|
eventCommandPip3 = "pmg_command_pip3"
|
|
eventCommandUv = "pmg_command_uv"
|
|
eventCommandPoetry = "pmg_command_poetry"
|
|
eventCommandPipx = "pmg_command_pipx"
|
|
eventCommandUvx = "pmg_command_uvx"
|
|
eventCommandGo = "pmg_command_go"
|
|
|
|
eventCommandNpx = "pmg_command_npx"
|
|
eventCommandPnpx = "pmg_command_pnpx"
|
|
|
|
eventPmgGenerateEnvDocker = "pmg_command_generate_env_docker"
|
|
eventPmgGenerateEnvGitHubActions = "pmg_command_generate_env_github_actions"
|
|
eventPmgGenerateEnvGitLabCI = "pmg_command_generate_env_gitlab_ci"
|
|
)
|
|
|
|
func TrackCommandRun() {
|
|
TrackEvent(eventRun)
|
|
}
|
|
|
|
func TrackCommandNpm() {
|
|
TrackEvent(eventCommandNpm)
|
|
}
|
|
|
|
func TrackCommandNpx() {
|
|
TrackEvent(eventCommandNpx)
|
|
}
|
|
|
|
func TrackCommandPnpx() {
|
|
TrackEvent(eventCommandPnpx)
|
|
}
|
|
|
|
func TrackCommandBun() {
|
|
TrackEvent(eventCommandBun)
|
|
}
|
|
|
|
func TrackCommandPnpm() {
|
|
TrackEvent(eventCommandPnpm)
|
|
}
|
|
|
|
func TrackCommandYarn() {
|
|
TrackEvent(eventCommandYarn)
|
|
}
|
|
|
|
func TrackCommandPip() {
|
|
TrackEvent(eventCommandPip)
|
|
}
|
|
|
|
func TrackCommandPip3() {
|
|
TrackEvent(eventCommandPip3)
|
|
}
|
|
|
|
func TrackCommandUv() {
|
|
TrackEvent(eventCommandUv)
|
|
}
|
|
|
|
func TrackCommandPoetry() {
|
|
TrackEvent(eventCommandPoetry)
|
|
}
|
|
|
|
func TrackCommandPipx() {
|
|
TrackEvent(eventCommandPipx)
|
|
}
|
|
|
|
func TrackCommandUvx() {
|
|
TrackEvent(eventCommandUvx)
|
|
}
|
|
|
|
func TrackCommandGo() {
|
|
TrackEvent(eventCommandGo)
|
|
}
|
|
|
|
func TrackCommandGenerateEnvDocker() {
|
|
TrackEvent(eventPmgGenerateEnvDocker)
|
|
}
|
|
|
|
func TrackCommandGenerateEnvGitHubActions() {
|
|
TrackEvent(eventPmgGenerateEnvGitHubActions)
|
|
}
|
|
|
|
func TrackCommandGenerateEnvGitLabCI() {
|
|
TrackEvent(eventPmgGenerateEnvGitLabCI)
|
|
}
|