mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahilb315
da098a51a8
Introduces proxy_install_only (default: false) which, when enabled, skips the proxy for package manager commands that do not download packages (e.g. npm ls, pip list), avoiding unnecessary MITM overhead. - Add ProxyInstallOnly to Config and config template - Add IsKnownDownloadCommand / MayDownloadPackages to ParsedCommand - Add DownloadCommands to npm and pypi PM configs covering update, ci, audit, dlx, exec, x, download, run and equivalents per PM - Extract shared runner.Execute used by both proxy flow and guard - Proxy flow short-circuits to runner.Execute for non-download commands when proxy_install_only=true
97 lines
3.3 KiB
Go
97 lines
3.3 KiB
Go
package packagemanager
|
|
|
|
import (
|
|
"context"
|
|
|
|
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
|
|
)
|
|
|
|
type Command struct {
|
|
Exe string
|
|
Args []string
|
|
}
|
|
|
|
type PackageInstallTarget struct {
|
|
PackageVersion *packagev1.PackageVersion
|
|
|
|
// Extras specifies additional features to be installed with a Python package
|
|
// Example: "django[mysql,redis]" has Extras as ["mysql", "redis"]
|
|
// Currently only specific to Python packages
|
|
Extras []string
|
|
}
|
|
|
|
func (pit *PackageInstallTarget) HasVersion() bool {
|
|
return pit.PackageVersion != nil && pit.PackageVersion.GetVersion() != ""
|
|
}
|
|
|
|
type ParsedCommand struct {
|
|
// Original command
|
|
Command Command
|
|
|
|
// Parsed install target if this is an install command
|
|
InstallTargets []*PackageInstallTarget
|
|
|
|
// IsManifestInstall indicates if this is a manifest-based installation
|
|
// (e.g., npm install, pip install -r requirements.txt)
|
|
IsManifestInstall bool
|
|
|
|
// ManifestFiles contains the list of manifest files to install from
|
|
// (e.g., ["requirements.txt"] for pip install -r requirements.txt)
|
|
ManifestFiles []string
|
|
|
|
// IsKnownDownloadCommand is true for commands that may download packages but are not
|
|
// fully parsed (e.g., npm update, npm ci, poetry update). Used by the proxy to decide
|
|
// whether to intercept when proxy_install_only is enabled.
|
|
IsKnownDownloadCommand bool
|
|
}
|
|
|
|
// IsInstallationCommand returns true if command installs packages (explicit targets or from manifest).
|
|
// This is used by guard mode where we need to know which packages are being installed.
|
|
func (pc *ParsedCommand) IsInstallationCommand() bool {
|
|
return pc.HasInstallTarget() || pc.HasManifestInstall()
|
|
}
|
|
|
|
// MayDownloadPackages returns true if the command may download packages from a registry.
|
|
// This is broader than IsInstallationCommand and includes commands like npm update or npm ci
|
|
// that download packages but are not fully parsed. Used by the proxy to decide interception scope.
|
|
func (pc *ParsedCommand) MayDownloadPackages() bool {
|
|
return pc.IsInstallationCommand() || pc.IsKnownDownloadCommand
|
|
}
|
|
|
|
func (pc *ParsedCommand) HasInstallTarget() bool {
|
|
return len(pc.InstallTargets) > 0
|
|
}
|
|
|
|
func (pc *ParsedCommand) HasManifestInstall() bool {
|
|
return pc.IsManifestInstall
|
|
}
|
|
|
|
func (pc *ParsedCommand) ShouldExtractFromManifest() bool {
|
|
return pc.IsManifestInstall && !pc.HasInstallTarget()
|
|
}
|
|
|
|
// PackageManager is the contract for implementing a package manager
|
|
type PackageManager interface {
|
|
// Name of the package manager implementation
|
|
Name() string
|
|
|
|
// ParseCommand parses the command and returns a parsed command
|
|
// specific to the package manager implementation
|
|
ParseCommand(args []string) (*ParsedCommand, error)
|
|
|
|
// Ecosystem of the package manager
|
|
Ecosystem() packagev1.Ecosystem
|
|
}
|
|
|
|
// PackageResolver is the contract for resolving package info
|
|
type PackageResolver interface {
|
|
// ResolveLatestVersion resolves the latest version for a given package
|
|
ResolveLatestVersion(context.Context, *packagev1.Package) (*packagev1.PackageVersion, error)
|
|
|
|
// ResolveDependencies resolves the dependencies for a given package version
|
|
// It returns a flattened list of all the dependencies based on implementation
|
|
// specific config. The version resolution is based on minimum version selection
|
|
// for a given version range.
|
|
ResolveDependencies(context.Context, *packagev1.PackageVersion) ([]*packagev1.PackageVersion, error)
|
|
}
|