Files
pmg/proxy/interceptors/go_url_parser_test.go
T
b19473945b Add experimental Go module proxy support (#358)
* feat: add experimental Go module support via pmg go

Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command
runs solely when invoked explicitly as `pmg go ...` and is deliberately
excluded from setup aliases and PATH shims so existing users are
unaffected.

- packagemanager: goPackageManager with fail-safe command classification
  (vet/fix excluded from non-download since they can fetch on a cold
  cache) and pinned-version extraction where only canonical semver
  counts as explicit.
- GOPROXY normalization (fail-closed): effective GOPROXY read via
  `go env` (honors go env -w), rebuilt comma-joined with `direct`
  dropped so a 403 block is terminal and nothing silently falls back to
  unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning;
  GOINSECURE is cleared. Contributed to the proxy flow through a new
  ProxyRoutingProvider hook (extra child env + dynamic MITM hosts).
- Go interceptor with dynamic host matching from the user's effective
  GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on
  .zip only (the sole endpoint that delivers code); .info/.mod/@latest/
  list pass through; /sumdb/ traffic and sum.golang.org are never
  touched so checksum-db verification stays intact; golang.org/toolchain
  is allowed on Go's own checksum verification.
- Dependency cooldown: publish time captured from .info responses
  (body unmodified), in-window .zip blocked with 403; fails open for
  cooldown only when the publish time was never observed.
- Cert gate: on macOS/Windows `pmg go` fails fast with actionable
  guidance unless the persisted PMG CA is OS-trusted (Go ignores
  SSL_CERT_FILE there); Linux works via the injected bundle.
- proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic
  cases (allow/block/confirm, case-escaped paths, cooldown block and
  fail-open, toolchain, sumdb passthrough).

Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0`
MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch,
and go.sum verification succeeds through the tunneled checksum db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* fix(go): address review findings on experimental Go support

- Drop fmt/clean from NonDownloadCommands: both load packages via go
  list and can download modules on a cold cache, which would bypass the
  proxy under install_only.
- Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at
  https://corp/goproxy): the interceptor now receives host -> base URL
  and strips the path prefix before parsing module URLs, so verdicts
  and cooldown key on the real module path.
- Default unschemed GOPROXY entries to https, matching go's own
  behavior, so corp mirrors configured as bare hosts are intercepted
  instead of silently unanalyzed.
- Memoize the final verdict per module zip: go re-requests a failed
  zip during go get's load phase, which double-recorded stats (the
  report showed the same blocked module twice) and would have
  re-prompted on Confirm verdicts.
- Fetch .info out-of-band on a cooldown cache miss: go serves .info
  from its local module cache on any machine that used go before PMG,
  which silently disabled cooldown. Failure of the side-fetch still
  fails open for cooldown only.
- Move the noop package resolver into packagemanager.

Verified live: cold-cache cooldown block now records once; warm-cache
rerun is blocked via the side-fetch instead of failing open.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

* docs: collapse Go proxy-mode details by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-03 18:19:31 +05:30

133 lines
3.4 KiB
Go

package interceptors
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestGoProxyParserParseURL(t *testing.T) {
cases := []struct {
name string
path string
wantName string
wantVersion string
wantType string
wantIsDownload bool
wantErrContains string
}{
{
name: "zip download",
path: "/github.com/x/y/@v/v1.2.3.zip",
wantName: "github.com/x/y",
wantVersion: "v1.2.3",
wantType: goRequestZip,
wantIsDownload: true,
},
{
name: "info metadata",
path: "/github.com/x/y/@v/v1.2.3.info",
wantName: "github.com/x/y",
wantVersion: "v1.2.3",
wantType: goRequestInfo,
},
{
name: "mod metadata",
path: "/github.com/x/y/@v/v1.2.3.mod",
wantName: "github.com/x/y",
wantVersion: "v1.2.3",
wantType: goRequestMod,
},
{
name: "version list",
path: "/github.com/x/y/@v/list",
wantName: "github.com/x/y",
wantType: goRequestList,
},
{
name: "latest metadata",
path: "/github.com/x/y/@latest",
wantName: "github.com/x/y",
wantType: goRequestLatest,
},
{
name: "case-escaped module path and version are decoded",
path: "/github.com/!burnt!sushi/toml/@v/!v1.0.0-!rc1.zip",
wantName: "github.com/BurntSushi/toml",
wantVersion: "V1.0.0-Rc1",
wantType: goRequestZip,
wantIsDownload: true,
},
{
name: "pseudo-version",
path: "/example.com/m/@v/v0.0.0-20191109021931-daa7c04131f5.zip",
wantName: "example.com/m",
wantVersion: "v0.0.0-20191109021931-daa7c04131f5",
wantType: goRequestZip,
wantIsDownload: true,
},
{
name: "incompatible version",
path: "/github.com/x/y/@v/v4.1.2+incompatible.zip",
wantName: "github.com/x/y",
wantVersion: "v4.1.2+incompatible",
wantType: goRequestZip,
wantIsDownload: true,
},
{
name: "proxied checksum database traffic",
path: "/sumdb/sum.golang.org/lookup/example.com/m@v1.0.0",
wantType: goRequestSumDB,
},
{
name: "sumdb capability check",
path: "/sumdb/sum.golang.org/supported",
wantType: goRequestSumDB,
},
{
name: "missing marker",
path: "/github.com/x/y",
wantErrContains: "missing /@v/",
},
{
name: "unknown suffix",
path: "/github.com/x/y/@v/v1.2.3.tar",
wantErrContains: "unrecognized go proxy version suffix",
},
{
name: "empty path",
path: "/",
wantErrContains: "empty go proxy URL path",
},
{
name: "version without suffix",
path: "/github.com/x/y/@v/v123",
wantErrContains: "no version suffix",
},
}
parser := goProxyParser{}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
info, err := parser.ParseURL(tc.path)
if tc.wantErrContains != "" {
require.Error(t, err)
assert.Contains(t, err.Error(), tc.wantErrContains)
return
}
require.NoError(t, err)
assert.Equal(t, tc.wantName, info.GetName())
assert.Equal(t, tc.wantVersion, info.GetVersion())
assert.Equal(t, tc.wantIsDownload, info.IsFileDownload())
goInfo, ok := info.(*goModuleInfo)
require.True(t, ok)
assert.Equal(t, tc.wantType, goInfo.requestType)
})
}
}