Documentation
¶
Overview ¶
Package hostrules holds the host-shape rules and artifact-registry tables the RUNTIME governance paths depend on — approval write-back, egress substitution, site-config validation and the artifact-redirect emitter.
These four helpers were extracted verbatim from internal/workspacescan, where they had accumulated for no better reason than that the scanner was written first. They are not scanning: ValidApprovedHost gates what an operator may promote into a durable allowlist (internal/api/approvals.go's learnVerifyEgress), HostOf is the URL→host parser site-config and the probes validate with, and PublicRegistryHosts/EmitArtifactConfig drive corporate artifact redirection. The scanner is scheduled for deletion in 0.5.x; these outlive it.
Leaf package by design (stdlib only), so both internal/api and — until it goes — internal/workspacescan can depend on it without a cycle.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EmitArtifactConfig ¶
EmitArtifactConfig turns operator-configured artifact-registry redirects (ecosystem -> corporate base URL) into the per-tool config each toolchain reads to pull from the corporate mirror instead of the public registry. Returns (files, env):
- files: path -> content, keyed by each tool's real config location relative to HOME (npm .npmrc, pip .config/pip/pip.conf, cargo .cargo/config.toml, maven .m2/settings.xml, nuget .nuget/NuGet/NuGet.Config). A dispatch-time writer drops them under $HOME; a committable export drops the repo-cascading ones (.npmrc/.cargo) usefully at the repo root and the rest as documentation.
- env: the go-toolchain variables (go redirects via GOPROXY/GOSUMDB env, not a file).
The output is URL-ONLY and carries NO secret — an injected registry token is applied proxy-side, never written into a committable/readable config file. Maven's settings.xml is intentionally MIRRORS-ONLY: the sandbox reaches the mirror THROUGH wardyn-proxy via MAVEN_OPTS (set platform-wide at dispatch), so no <proxies> block is emitted here — which also keeps a committed settings.xml free of the sandbox-only wardyn-proxy hostname (mirrors=which-URL is additive to proxies=how-to-reach, which lives in MAVEN_OPTS). GOPRIVATE is deliberately NOT set: GOPRIVATE="*" would route modules to direct VCS and defeat the corp GOPROXY, and GOSUMDB=off already disables the checksum DB the corp proxy may not serve. Pure + deterministic; unknown/empty ecosystems are skipped.
Injection safety: base URLs come from site-config, which validateSiteConfig already rejects if they contain control chars or shell/XML metacharacters (`$;&|<>"'\), so embedding base verbatim into TOML/XML/ini here is safe.
func PublicRegistryHosts ¶
PublicRegistryHosts returns the public-registry hosts a corporate redirect replaces for an artifact ecosystem (npm|pip|go|cargo|maven|nuget), or nil for an unknown key. The egress-substitution layer drops these and adds the corp host when the operator configures a redirect for that ecosystem.
func ValidApprovedHost ¶
ValidApprovedHost reports whether h is a plain lowercase dotted host of the exact shape the approved-egress API accepts for operator promotion (no scheme, port, path, or wildcard; wildcards remain a policy-allowlist privilege).
Types ¶
This section is empty.
Source Files