mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
* feat: add experimental Go module support via pmg go Adds Go modules as a proxy-guarded ecosystem, opt-in only: the command runs solely when invoked explicitly as `pmg go ...` and is deliberately excluded from setup aliases and PATH shims so existing users are unaffected. - packagemanager: goPackageManager with fail-safe command classification (vet/fix excluded from non-download since they can fetch on a cold cache) and pinned-version extraction where only canonical semver counts as explicit. - GOPROXY normalization (fail-closed): effective GOPROXY read via `go env` (honors go env -w), rebuilt comma-joined with `direct` dropped so a 403 block is terminal and nothing silently falls back to unanalyzed VCS fetches. GOPRIVATE/GONOPROXY surface a warning; GOINSECURE is cleared. Contributed to the proxy flow through a new ProxyRoutingProvider hook (extra child env + dynamic MITM hosts). - Go interceptor with dynamic host matching from the user's effective GOPROXY via InterceptorContext.GoProxyHosts. Malware analysis runs on .zip only (the sole endpoint that delivers code); .info/.mod/@latest/ list pass through; /sumdb/ traffic and sum.golang.org are never touched so checksum-db verification stays intact; golang.org/toolchain is allowed on Go's own checksum verification. - Dependency cooldown: publish time captured from .info responses (body unmodified), in-window .zip blocked with 403; fails open for cooldown only when the publish time was never observed. - Cert gate: on macOS/Windows `pmg go` fails fast with actionable guidance unless the persisted PMG CA is OS-trusted (Go ignores SSL_CERT_FILE there); Linux works via the injected bundle. - proxye2e: GOPROXY-protocol mock registry, Go driver and 10 hermetic cases (allow/block/confirm, case-escaped paths, cooldown block and fail-open, toolchain, sumdb passthrough). Verified end-to-end on Linux: `pmg go get github.com/google/uuid@v1.6.0` MITMs proxy.golang.org, analyzes the decoded module at the .zip fetch, and go.sum verification succeeds through the tunneled checksum db. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * fix(go): address review findings on experimental Go support - Drop fmt/clean from NonDownloadCommands: both load packages via go list and can download modules on a cold cache, which would bypass the proxy under install_only. - Support GOPROXY entries with a base path (e.g. corp Athens/JFrog at https://corp/goproxy): the interceptor now receives host -> base URL and strips the path prefix before parsing module URLs, so verdicts and cooldown key on the real module path. - Default unschemed GOPROXY entries to https, matching go's own behavior, so corp mirrors configured as bare hosts are intercepted instead of silently unanalyzed. - Memoize the final verdict per module zip: go re-requests a failed zip during go get's load phase, which double-recorded stats (the report showed the same blocked module twice) and would have re-prompted on Confirm verdicts. - Fetch .info out-of-band on a cooldown cache miss: go serves .info from its local module cache on any machine that used go before PMG, which silently disabled cooldown. Failure of the side-fetch still fails open for cooldown only. - Move the noop package resolver into packagemanager. Verified live: cold-cache cooldown block now records once; warm-cache rerun is blocked via the side-fetch instead of failing open. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK * docs: collapse Go proxy-mode details by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014xuhBeTVpfU4SdqVaarvuK --------- Co-authored-by: Claude <noreply@anthropic.com>
165 lines
4.8 KiB
Go
165 lines
4.8 KiB
Go
package packagemanager
|
|
|
|
import (
|
|
"testing"
|
|
|
|
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGoPackageManagerParseCommand(t *testing.T) {
|
|
type target struct {
|
|
name string
|
|
version string
|
|
explicit bool
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
args []string
|
|
nonDownload bool
|
|
manifestInstall bool
|
|
targets []target
|
|
wantManifestFiles []string
|
|
}{
|
|
{
|
|
name: "go version is non-download",
|
|
args: []string{"go", "version"},
|
|
nonDownload: true,
|
|
},
|
|
{
|
|
name: "go env is non-download",
|
|
args: []string{"go", "env", "GOPROXY"},
|
|
nonDownload: true,
|
|
},
|
|
{
|
|
name: "go vet is not non-download (can fetch on cold cache)",
|
|
args: []string{"go", "vet", "./..."},
|
|
},
|
|
{
|
|
name: "go fmt is not non-download (runs go list, can fetch on cold cache)",
|
|
args: []string{"go", "fmt", "./..."},
|
|
},
|
|
{
|
|
name: "go clean is not non-download (loads packages, can fetch on cold cache)",
|
|
args: []string{"go", "clean", "./..."},
|
|
},
|
|
{
|
|
name: "go build runs with proxy",
|
|
args: []string{"go", "build", "./..."},
|
|
},
|
|
{
|
|
name: "go get with canonical version",
|
|
args: []string{"go", "get", "github.com/x/y@v1.2.3"},
|
|
targets: []target{{name: "github.com/x/y", version: "v1.2.3", explicit: true}},
|
|
},
|
|
{
|
|
name: "go get with pseudo-version is explicit",
|
|
args: []string{"go", "get", "github.com/x/y@v0.0.0-20191109021931-daa7c04131f5"},
|
|
targets: []target{{name: "github.com/x/y", version: "v0.0.0-20191109021931-daa7c04131f5", explicit: true}},
|
|
},
|
|
{
|
|
name: "go install with latest query is not explicit",
|
|
args: []string{"go", "install", "github.com/x/y/cmd/y@latest"},
|
|
targets: []target{{name: "github.com/x/y/cmd/y", version: "latest", explicit: false}},
|
|
},
|
|
{
|
|
name: "go get with branch query is not explicit",
|
|
args: []string{"go", "get", "github.com/x/y@master"},
|
|
targets: []target{{name: "github.com/x/y", version: "master", explicit: false}},
|
|
},
|
|
{
|
|
name: "go install local path yields no target",
|
|
args: []string{"go", "install", "./cmd/foo"},
|
|
},
|
|
{
|
|
name: "go run current dir yields no target",
|
|
args: []string{"go", "run", "."},
|
|
},
|
|
{
|
|
name: "go get without version",
|
|
args: []string{"go", "get", "example.com/m"},
|
|
targets: []target{{name: "example.com/m", version: "", explicit: false}},
|
|
},
|
|
{
|
|
name: "flags before target are skipped",
|
|
args: []string{"go", "get", "-u", "example.com/m@v2.0.0"},
|
|
targets: []target{{name: "example.com/m", version: "v2.0.0", explicit: true}},
|
|
},
|
|
{
|
|
name: "go mod tidy is manifest install",
|
|
args: []string{"go", "mod", "tidy"},
|
|
manifestInstall: true,
|
|
wantManifestFiles: []string{"go.mod"},
|
|
},
|
|
{
|
|
name: "go mod download without args is manifest install",
|
|
args: []string{"go", "mod", "download"},
|
|
manifestInstall: true,
|
|
wantManifestFiles: []string{"go.mod"},
|
|
},
|
|
{
|
|
name: "go mod download with module",
|
|
args: []string{"go", "mod", "download", "example.com/m@v1.0.0"},
|
|
targets: []target{{name: "example.com/m", version: "v1.0.0", explicit: true}},
|
|
},
|
|
{
|
|
name: "no subcommand",
|
|
args: []string{"go"},
|
|
},
|
|
}
|
|
|
|
pm, err := NewGoPackageManager(DefaultGoPackageManagerConfig())
|
|
require.NoError(t, err)
|
|
|
|
assert.Equal(t, "go", pm.Name())
|
|
assert.Equal(t, packagev1.Ecosystem_ECOSYSTEM_GO, pm.Ecosystem())
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
parsed, err := pm.ParseCommand(tc.args)
|
|
require.NoError(t, err)
|
|
|
|
assert.Equal(t, tc.nonDownload, parsed.IsKnownNonDownloadCommand)
|
|
assert.Equal(t, tc.manifestInstall, parsed.IsManifestInstall)
|
|
assert.Equal(t, tc.wantManifestFiles, parsed.ManifestFiles)
|
|
|
|
require.Len(t, parsed.InstallTargets, len(tc.targets))
|
|
for i, want := range tc.targets {
|
|
got := parsed.InstallTargets[i]
|
|
assert.Equal(t, want.name, got.PackageVersion.GetPackage().GetName())
|
|
assert.Equal(t, want.version, got.PackageVersion.GetVersion())
|
|
assert.Equal(t, want.explicit, got.IsExplicitVersion)
|
|
assert.Equal(t, packagev1.Ecosystem_ECOSYSTEM_GO, got.PackageVersion.GetPackage().GetEcosystem())
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsGoRemoteModuleTarget(t *testing.T) {
|
|
cases := []struct {
|
|
target string
|
|
want bool
|
|
}{
|
|
{"github.com/x/y", true},
|
|
{"example.com/m@v1.0.0", true},
|
|
{"gopkg.in/yaml.v3", true},
|
|
{".", false},
|
|
{"..", false},
|
|
{"./cmd/foo", false},
|
|
{"../pkg", false},
|
|
{"/abs/path", false},
|
|
{"./...", false},
|
|
{"...", false},
|
|
{`a\b`, false},
|
|
{"", false},
|
|
{"fmt", false},
|
|
{"cmd/foo", false},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
assert.Equal(t, tc.want, isGoRemoteModuleTarget(tc.target), "target %q", tc.target)
|
|
}
|
|
}
|