This repository has been archived by the owner on Mar 20, 2023. It is now read-only.
forked from gomods/athens
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
actions: support proxying sum db urls (gomods#1208)
* actions: support proxying sum db urls * remove proxy prefix * add docs for checksum db * more docs * typo * typo * typo * typo * typo * typo * typo * typo * move checksum db into its own section
- Loading branch information
1 parent
e7d7749
commit 0cac0ed
Showing
10 changed files
with
238 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package actions | ||
|
|
||
| import ( | ||
| "net/http" | ||
| "net/http/httputil" | ||
| "net/url" | ||
| "path" | ||
| "strings" | ||
| ) | ||
|
|
||
| func sumdbPoxy(url *url.URL, nosumPatterns []string) http.Handler { | ||
| rp := httputil.NewSingleHostReverseProxy(url) | ||
| rp.Director = func(req *http.Request) { | ||
| req.Host = url.Host | ||
| req.URL.Scheme = url.Scheme | ||
| req.URL.Host = url.Host | ||
| } | ||
| if len(nosumPatterns) > 0 { | ||
| return noSumWrapper(rp, url.Host, nosumPatterns) | ||
| } | ||
| return rp | ||
| } | ||
|
|
||
| func noSumWrapper(h http.Handler, host string, patterns []string) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| if strings.HasPrefix(r.URL.Path, "/lookup/") { | ||
| for _, p := range patterns { | ||
| if isMatch, err := path.Match(p, r.URL.Path[len("/lookup/"):]); err == nil && isMatch { | ||
| w.WriteHeader(http.StatusForbidden) | ||
| return | ||
| } | ||
| } | ||
| } | ||
| h.ServeHTTP(w, r) | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| package actions | ||
|
|
||
| import ( | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "net/url" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestSumdbProxy(t *testing.T) { | ||
| var givenURL string | ||
| expectedURL := "/latest" | ||
| s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| givenURL = r.URL.Path | ||
| })) | ||
| defer s.Close() | ||
|
|
||
| surl, err := url.Parse(s.URL) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| pathPrefix := "/sumdb/" + surl.Host | ||
| h := sumdbPoxy(surl, nil) | ||
| h = http.StripPrefix(pathPrefix, h) | ||
|
|
||
| targetURL := "/sumdb/" + surl.Host + "/latest" | ||
| req := httptest.NewRequest("GET", targetURL, nil) | ||
| w := httptest.NewRecorder() | ||
| h.ServeHTTP(w, req) | ||
|
|
||
| if w.Code != 200 { | ||
| t.Fatalf("expected to return 200 but got %v", w.Code) | ||
| } | ||
|
|
||
| if givenURL != expectedURL { | ||
| t.Fatalf("expected the URL to be %v but got %v", expectedURL, givenURL) | ||
| } | ||
| } | ||
|
|
||
| var noSumTestCases = []struct { | ||
| name string | ||
| patterns []string | ||
| given string | ||
| status int | ||
| }{ | ||
| { | ||
| "no match", | ||
| []string{"github.com/private/repo"}, | ||
| "github.com/public/[email protected]", | ||
| http.StatusOK, | ||
| }, | ||
| { | ||
| "exact match", | ||
| []string{"github.com/private/[email protected]"}, | ||
| "github.com/private/[email protected]", | ||
| http.StatusForbidden, | ||
| }, | ||
| { | ||
| "star match", | ||
| []string{"github.com/private/*"}, | ||
| "github.com/private/[email protected]", | ||
| http.StatusForbidden, | ||
| }, | ||
| { | ||
| "any version", | ||
| []string{"github.com/private/repo*"}, | ||
| "github.com/private/[email protected]", | ||
| http.StatusForbidden, | ||
| }, | ||
| } | ||
|
|
||
| func TestNoSumPatterns(t *testing.T) { | ||
| for _, tc := range noSumTestCases { | ||
| t.Run(tc.name, func(t *testing.T) { | ||
| w := httptest.NewRecorder() | ||
| skipHandler := noSumWrapper(http.HandlerFunc(emptyHandler), "sum.golang.org", tc.patterns) | ||
| req := httptest.NewRequest("GET", "/lookup/"+tc.given, nil) | ||
| skipHandler.ServeHTTP(w, req) | ||
| if tc.status != w.Code { | ||
| t.Fatalf("expected NoSum wrapper to return %v but got %v", tc.status, w.Code) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func emptyHandler(w http.ResponseWriter, r *http.Request) {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| --- | ||
| title: Checksum DB | ||
| description: Proxying A Checksum DB API | ||
| weight: 2 | ||
| --- | ||
|
|
||
| ## Proxying A Checksum DB | ||
| The Athens Proxy has the ability to proxy a Checksum Database as defined by [this proposal](https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md) by the Go team. | ||
|
|
||
| Athens by defualt will accept proxying `https://sum.golang.org`. However, if you'd like to override that behavior or proxy more Checksum DBs you can do so through the `SumDBs` config or its equivalent Environment Variable: `ATHENS_SUM_DBS` | ||
|
|
||
| So for example, if you run the following command: | ||
|
|
||
| ```bash | ||
| GOPROXY=<athens-url> go build | ||
| ``` | ||
|
|
||
| The Go command will proxy requests to `sum.golang.org` like this: `<athens-url>/sumdb/sum.golang.org`. Feel free to read the linked proposal above for the exact requests that makes Athens successfully proxy Checksum DB APIs. | ||
|
|
||
| Note that as of this documentation (May 2019), you need to explicitly set `GOSUMDB=https://sum.golang.org`, but the Go team is planning on enabling this by defualt. | ||
|
|
||
| ### Why a Checksum DB? | ||
|
|
||
| The reasons for needing a Checksum DB is explained in the linked proposal above. However, the reasons for proxying a Checksum DB are more explained below. | ||
|
|
||
| ### Why Proxy a Checksum DB? | ||
|
|
||
| This is quite important. Say you are a company that is running an Athens instance, and you don't want the world to konw about where your | ||
| repositories live. For example, say you have a private repo under `github.com/mycompany/secret-repo`. In order to ensure that the Go client | ||
| does not send a request to `https://sum.golang.org/lookup/github.com/mycompany/[email protected]` and therefore leaking your private import path to the public, you need to ensure that you tell Go to skip particular import paths as such: | ||
|
|
||
| ``` | ||
| GONOSUMDB=github.com/mycompany/* go build | ||
| ``` | ||
|
|
||
| This will make sure that Go does not send any requests to the Checksum DB for your private import paths. | ||
| However, how can you ensure that all of your employees are building private code with the right configuration? | ||
|
|
||
| Athens, in this case can help ensure that all private code flowing through it never goes to the Checksum DB. So as long as your employees are using Athens, then they will get a helpful reminder to ensure Their GONOSUMDB is rightly configured. | ||
|
|
||
| As the Athens company maintainer, you can run Athens with the following configuration: | ||
|
|
||
| `NoSumPatterns = ["github.com/mycompany/*] # or comma separted env var: ATHENS_GONOSUM_PATTERNS` | ||
|
|
||
| This will ensure that when Go sends a request to `<athens-url/sumdb/sum.golang.org/github.com/mycompany/[email protected]>`, Athens will return a 403 and failing the build ensuring that the client knows something is not configured correctly and also never leaking those import paths |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters