Files
pmg/test/proxye2e/driver.go
T
b19473945b Add experimental Go module proxy support (#358)
* feat: add experimental Go module support via pmg go

Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command
runs solely when invoked explicitly as `pmg go ...` and is deliberately
excluded from setup aliases and PATH shims so existing users are
unaffected.

- packagemanager: goPackageManager with fail-safe command classification
  (vet/fix excluded from non-download since they can fetch on a cold
  cache) and pinned-version extraction where only canonical semver
  counts as explicit.
- GOPROXY normalization (fail-closed): effective GOPROXY read via
  `go env` (honors go env -w), rebuilt comma-joined with `direct`
  dropped so a 403 block is terminal and nothing silently falls back to
  unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning;
  GOINSECURE is cleared. Contributed to the proxy flow through a new
  ProxyRoutingProvider hook (extra child env + dynamic MITM hosts).
- Go interceptor with dynamic host matching from the user's effective
  GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on
  .zip only (the sole endpoint that delivers code); .info/.mod/@latest/
  list pass through; /sumdb/ traffic and sum.golang.org are never
  touched so checksum-db verification stays intact; golang.org/toolchain
  is allowed on Go's own checksum verification.
- Dependency cooldown: publish time captured from .info responses
  (body unmodified), in-window .zip blocked with 403; fails open for
  cooldown only when the publish time was never observed.
- Cert gate: on macOS/Windows `pmg go` fails fast with actionable
  guidance unless the persisted PMG CA is OS-trusted (Go ignores
  SSL_CERT_FILE there); Linux works via the injected bundle.
- proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic
  cases (allow/block/confirm, case-escaped paths, cooldown block and
  fail-open, toolchain, sumdb passthrough).

Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0`
MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch,
and go.sum verification succeeds through the tunneled checksum db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* fix(go): address review findings on experimental Go support

- Drop fmt/clean from NonDownloadCommands: both load packages via go
  list and can download modules on a cold cache, which would bypass the
  proxy under install_only.
- Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at
  https://corp/goproxy): the interceptor now receives host -> base URL
  and strips the path prefix before parsing module URLs, so verdicts
  and cooldown key on the real module path.
- Default unschemed GOPROXY entries to https, matching go's own
  behavior, so corp mirrors configured as bare hosts are intercepted
  instead of silently unanalyzed.
- Memoize the final verdict per module zip: go re-requests a failed
  zip during go get's load phase, which double-recorded stats (the
  report showed the same blocked module twice) and would have
  re-prompted on Confirm verdicts.
- Fetch .info out-of-band on a cooldown cache miss: go serves .info
  from its local module cache on any machine that used go before PMG,
  which silently disabled cooldown. Failure of the side-fetch still
  fails open for cooldown only.
- Move the noop package resolver into packagemanager.

Verified live: cold-cache cooldown block now records once; warm-cache
rerun is blocked via the side-fetch instead of failing open.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* docs: collapse Go proxy-mode details by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-03 18:19:31 +05:30

189 lines
5.0 KiB
Go

package proxye2e
import (
"encoding/json"
"fmt"
"strings"
)
type RequestOutcome struct {
URL string
StatusCode int
Blocked bool
Body string
Err error
}
// ExecResult is the aggregate of requests an install driver issued.
type ExecResult struct {
Requests []RequestOutcome
}
func (e *ExecResult) add(o RequestOutcome) { e.Requests = append(e.Requests, o) }
// Blocked reports whether any request was blocked by the proxy.
func (e ExecResult) Blocked() bool {
for _, r := range e.Requests {
if r.Blocked {
return true
}
}
return false
}
type NpmDriver struct{ h *Harness }
type NpmMetadata struct {
Outcome RequestOutcome
DistTags map[string]string `json:"dist-tags"`
Versions map[string]json.RawMessage `json:"versions"`
Time map[string]string `json:"time"`
}
func (m NpmMetadata) HasVersion(v string) bool {
_, ok := m.Versions[v]
return ok
}
func (d NpmDriver) FetchMetadata(name string) NpmMetadata {
out := d.h.get(fmt.Sprintf("https://registry.npmjs.org/%s", name), nil)
meta := NpmMetadata{Outcome: out}
if out.Err == nil && out.StatusCode == 200 {
if err := json.Unmarshal([]byte(out.Body), &meta); err != nil {
meta.Outcome.Err = fmt.Errorf("failed to decode npm metadata for %s: %w", name, err)
}
}
return meta
}
func (d NpmDriver) Download(name, version string) RequestOutcome {
return d.h.get(fmt.Sprintf("https://registry.npmjs.org/%s/-/%s-%s.tgz", name, name, version), nil)
}
// Install replays npm's resolve-then-download sequence: fetch the packument,
// pick the requested version (or dist-tags.latest), and download it only if it
// survived in the metadata the proxy returned.
func (d NpmDriver) Install(name, version string) ExecResult {
res := ExecResult{}
meta := d.FetchMetadata(name)
res.add(meta.Outcome)
target := version
if target == "" {
target = meta.DistTags["latest"]
}
if target != "" && meta.HasVersion(target) {
res.add(d.Download(name, target))
}
return res
}
type GoDriver struct{ h *Harness }
func (d GoDriver) goProxyURL(modulePath, version, ext string) string {
return fmt.Sprintf("https://proxy.golang.org/%s/@v/%s%s",
goEscapePath(modulePath), goEscapeVersion(version), ext)
}
// DownloadZipVia fetches a module zip from an arbitrary GOPROXY base URL,
// e.g. a corporate proxy serving under a path prefix.
func (d GoDriver) DownloadZipVia(baseURL, modulePath, version string) RequestOutcome {
return d.h.get(fmt.Sprintf("%s/%s/@v/%s.zip",
baseURL, goEscapePath(modulePath), goEscapeVersion(version)), nil)
}
func (d GoDriver) FetchInfo(modulePath, version string) RequestOutcome {
return d.h.get(d.goProxyURL(modulePath, version, ".info"), nil)
}
func (d GoDriver) FetchMod(modulePath, version string) RequestOutcome {
return d.h.get(d.goProxyURL(modulePath, version, ".mod"), nil)
}
func (d GoDriver) DownloadZip(modulePath, version string) RequestOutcome {
return d.h.get(d.goProxyURL(modulePath, version, ".zip"), nil)
}
// Install replays go's fetch sequence for a resolved module version:
// .info, then .mod, then the .zip source archive.
func (d GoDriver) Install(modulePath, version string) ExecResult {
res := ExecResult{}
info := d.FetchInfo(modulePath, version)
res.add(info)
if info.Err != nil || info.StatusCode != 200 {
return res
}
res.add(d.FetchMod(modulePath, version))
res.add(d.DownloadZip(modulePath, version))
return res
}
type PypiDriver struct{ h *Harness }
type PypiSimpleFile struct {
Filename string `json:"filename"`
URL string `json:"url"`
UploadTime string `json:"upload-time"`
}
type PypiSimple struct {
Outcome RequestOutcome
Files []PypiSimpleFile `json:"files"`
}
func (s PypiSimple) fileForVersion(name, version string) (PypiSimpleFile, bool) {
prefix := fmt.Sprintf("%s-%s.", normalizePypiName(name), version)
for _, f := range s.Files {
if strings.HasPrefix(f.Filename, prefix) {
return f, true
}
}
return PypiSimpleFile{}, false
}
func (s PypiSimple) HasVersion(name, version string) bool {
_, ok := s.fileForVersion(name, version)
return ok
}
func (d PypiDriver) FetchSimple(name string) PypiSimple {
out := d.h.get(
fmt.Sprintf("https://pypi.org/simple/%s/", normalizePypiName(name)),
map[string]string{"Accept": pypiSimpleContentType},
)
simple := PypiSimple{Outcome: out}
if out.Err == nil && out.StatusCode == 200 {
if err := json.Unmarshal([]byte(out.Body), &simple); err != nil {
simple.Outcome.Err = fmt.Errorf("failed to decode PyPI simple index for %s: %w", name, err)
}
}
return simple
}
func (d PypiDriver) Download(fileURL string) RequestOutcome {
return d.h.get(fileURL, nil)
}
// Install replays pip's resolve-then-download sequence over the PEP 691 Simple
// API: fetch the index, then download the requested version's file only if it
// survived cooldown stripping.
func (d PypiDriver) Install(name, version string) ExecResult {
res := ExecResult{}
simple := d.FetchSimple(name)
res.add(simple.Outcome)
if f, ok := simple.fileForVersion(name, version); ok {
res.add(d.Download(f.URL))
}
return res
}