mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
327c9c7068
* feat(cooldown): respect trusted_packages in dependency cooldown Trusted packages are now treated as a superset waiver that bypasses every PMG control (malware analysis, cooldown, and any future controls). A globally trusted package is automatically exempt from the cooldown window and no longer needs a duplicate entry in dependency_cooldown.skip. The skip list remains the narrower, cooldown-only waiver for packages that must bypass the cooldown wait but still be malware-scanned. * refactor(cooldown): tag skip reason and audit-log skipped packages Address review feedback on #342: - Restore cooldownSkip to a pure single-list function (SRP); the merge into trusted_packages now happens in a separate mergeCooldownSkip step, driven by the exported CooldownSkip wrapper. - Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage / CooldownSkipList) on both SkipAll and per-version entries, so callers can tell apart the broad waiver from the cooldown-only one. When both lists match the same package, trusted_packages wins. - Add audit.LogCooldownSkipped and emit it from the npm and PyPI interceptors on the SkipAll path, alongside the existing info log, carrying the source list as the reason. * refactor(cooldown): inline list merge, audit per-version exemptions Address further review feedback: - Drop the separate mergeCooldownSkip helper; cooldownSkip now writes into a shared *CooldownSkipInfo and is called twice from CooldownSkip (cooldown skip list first, trusted_packages on top so trusted entries override the reason on overlap). - Audit log every exemption, not just SkipAll: a new auditCooldownSkip helper in proxy/interceptors/cooldown.go emits one event per match (package-wide or per-version), each tagged with its source list. LogCooldownSkipped gains a version argument for the per-version case. - Cover the trusted_packages reason path in TestCooldownSkip. * fix(cooldown): avoid double-auditing trusted package exemptions auditCooldownSkip now only emits EventTypeCooldownSkipped for entries that came from dependency_cooldown.skip. Trusted-package exemptions already get an EventTypeInstallTrustedAllowed event at tarball-download time (proxy/interceptors/base_registry.go), so emitting a cooldown event for them too would double-count the same waiver. * emit trusted and cooldown skip events to cloud * fix tests * refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll Address PR review feedback: - Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo instead of mutating an input pointer. - Add mergeCooldownSkip to combine per-list results with trusted_packages taking precedence on overlap. - CooldownSkip now consults trusted_packages first and returns immediately on a package-wide trusted exemption (DC skip list cannot add anything). - Extend tests to cover disjoint pinned entries across both lists and the case where DC version-less subsumes a trusted pinned entry. * fix(audit): address cooldown review feedback * fix(cooldown): audit cooldown skips at download time with concrete version Backend rejects PackageVersion messages without a version, and audit logs should reflect the runtime fact (a specific version was skipped) rather than the config rule. Move the audit emission from metadata-request handling to download-request handling, where the concrete version is known, and require version in LogCooldownSkipped. * chore(audit): drop dead scope assignment in LogCooldownSkipped * refactor(cooldown): move skip-list logic into cooldown handlers Registry interceptors no longer compute CooldownSkip or branch on SkipAll; they just call HandleMetadataRequest. The npm and pypi cooldown handlers own the skip lookup, the package-wide exemption short-circuit, and (for pypi) the canonical-name denormalization. Also align LogCooldownSkipped with other LogXxx signatures by taking *packagev1.PackageVersion. * fix: Simplify audit logging for dependency cooldown skip * refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages * fix: Code review fixes * fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped --------- Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
109 lines
3.0 KiB
Go
109 lines
3.0 KiB
Go
package audit
|
|
|
|
import (
|
|
"time"
|
|
|
|
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
|
|
)
|
|
|
|
// SessionData carries aggregate session statistics for session-complete events.
|
|
type SessionData struct {
|
|
PackageManager string
|
|
FlowType FlowType
|
|
Outcome Outcome
|
|
TotalAnalyzed uint32
|
|
AllowedCount uint32
|
|
BlockedCount uint32
|
|
ConfirmedCount uint32
|
|
TrustedSkipped uint32
|
|
InsecureBypassed uint32
|
|
CooldownBlockedCount uint32
|
|
Duration time.Duration
|
|
SandboxEnabled bool
|
|
ParanoidMode bool
|
|
TransitiveEnabled bool
|
|
}
|
|
|
|
// FlowType identifies how PMG intercepted the package installation.
|
|
type FlowType string
|
|
|
|
const (
|
|
FlowTypeGuard FlowType = "guard"
|
|
FlowTypeProxy FlowType = "proxy"
|
|
)
|
|
|
|
// Outcome describes the final result of a PMG invocation.
|
|
type Outcome string
|
|
|
|
const (
|
|
OutcomeSuccess Outcome = "success"
|
|
OutcomeBlocked Outcome = "blocked"
|
|
OutcomeUserCancelled Outcome = "user_cancelled"
|
|
OutcomeDryRun Outcome = "dry_run"
|
|
OutcomeError Outcome = "error"
|
|
OutcomeInsecureBypass Outcome = "insecure_bypass"
|
|
)
|
|
|
|
type EventType string
|
|
|
|
const (
|
|
EventTypeMalwareBlocked EventType = "malware_blocked"
|
|
EventTypeMalwareConfirmed EventType = "malware_confirmed"
|
|
EventTypeInstallAllowed EventType = "install_allowed"
|
|
EventTypeInstallTrustedAllowed EventType = "install_trusted_allowed"
|
|
EventTypeInstallStarted EventType = "install_started"
|
|
EventTypeDependencyResolved EventType = "dependency_resolved"
|
|
EventTypeInstallInsecureBypass EventType = "install_insecure_bypass"
|
|
EventTypeProxyHostObserved EventType = "proxy_host_observed"
|
|
EventTypeDependencyCooldown EventType = "dependency_cooldown"
|
|
EventTypeCooldownSkipped EventType = "dependency_cooldown_skipped"
|
|
EventTypeSandboxOverride EventType = "sandbox_override"
|
|
EventTypeError EventType = "error"
|
|
EventTypeSessionComplete EventType = "session_complete"
|
|
)
|
|
|
|
// AuditEvent is the canonical audit event for PMG. It carries all data any
|
|
// sink might need. Fields are zero-valued when not applicable to the event type.
|
|
type AuditEvent struct {
|
|
Type EventType
|
|
Timestamp time.Time
|
|
Message string
|
|
|
|
// Typed package version — populated for package-level events.
|
|
PackageVersion *packagev1.PackageVersion
|
|
|
|
// Analysis context
|
|
AnalysisID string
|
|
IsMalware bool
|
|
IsVerified bool
|
|
|
|
// Freeform details for backward-compatible eventlog output.
|
|
Details map[string]interface{}
|
|
|
|
// Install context
|
|
PackageManager string
|
|
Args []string
|
|
PackageCount int
|
|
|
|
// Sandbox context
|
|
ProfileName string
|
|
Overrides []map[string]string
|
|
|
|
// Proxy context
|
|
Hostname string
|
|
Method string
|
|
Reason string
|
|
|
|
// Cooldown context
|
|
PublishDate time.Time
|
|
CooldownDays int
|
|
DaysAgo int
|
|
DaysLeft int
|
|
|
|
// Error context
|
|
Error error
|
|
|
|
// Session summary data — populated only for EventTypeSessionComplete
|
|
SessionData *SessionData
|
|
}
|