pmg/ebpf-poc at d987512ccf3e3f6f3d021c4d0982329c65715d88 - pmg

mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00

Files

T

Sahilb315 d987512ccf feat(ebpf-poc): manage the proxy CA and npm trust

Redirecting a package manager into the proxy is only half the job. The
client then has to trust the proxy's certificate, and npm will not,
because Node from nodejs.org compiles its own roots into the binary and
ignores the system trust store.

Adds `pmgwatch ca` with install, status and remove.

install persists a CA keypair through PMG's own certmanager, so the
certificate survives a proxy restart. Without a persisted CA the daemon
generates an ephemeral one on every start and trust has to be redone
each time. The private key is left owned by the proxy user at 0600, and
a separate public bundle is written for npm, so npm never needs access
to the key.

npm is configured through `npm config set cafile --location=user`, run
as the target user. Environment variables that could shadow that config
are stripped from the child so the read-back verification is
meaningful. The previous cafile is recorded and restored on remove.

install refuses to run while the proxy is up, since the daemon reads the
certificate at startup, and refuses to change options against existing
state so a half-migrated setup cannot happen.

2026-07-28 17:47:47 +05:30

bpf_bpfeb.go

implement decision logic

2026-07-27 13:51:09 +05:30

bpf_bpfeb.o

feat(ebpf-poc): redirect eligible connections to the proxy

2026-07-27 14:18:47 +05:30

bpf_bpfel.go

implement decision logic

2026-07-27 13:51:09 +05:30

bpf_bpfel.o

feat(ebpf-poc): redirect eligible connections to the proxy