Documentation
¶
Overview ¶
Package audit checks that the archive served for each plugin version matches its recorded hash.
Index ¶
- Constants
- Variables
- func CheckTags(ctx context.Context, t *TagChecker, results []Result, concurrency int)
- func IsGitHubModule(mod string) bool
- func SelectWarmup(ctx context.Context, t *TagChecker, entries []catalog.Entry, ...) []catalog.Entry
- func WriteDiff(w io.Writer, d Diff)
- func WriteReport(w io.Writer, baseURL string, results []Result)
- type Change
- type Client
- type Diff
- type Download
- type Result
- type TagCheck
- type TagChecker
- func (t *TagChecker) Check(ctx context.Context, mod, version string) *TagCheck
- func (t *TagChecker) Gone(ctx context.Context, entry catalog.Entry) (bool, error)
- func (t *TagChecker) HasDependencies(ctx context.Context, mod, version string) (bool, error)
- func (t *TagChecker) ProxyCommit(ctx context.Context, mod, version string) (string, error)
Constants ¶
const ( // VerdictOK the served archive matches the recorded hash and validate accepts it. VerdictOK = "ok" // VerdictMismatch the served archive does not match the recorded hash. VerdictMismatch = "mismatch" // VerdictValidateFailed the served archive matches the recorded hash but validate rejects it. VerdictValidateFailed = "validate_failed" // VerdictDownloadError the archive is not served. VerdictDownloadError = "download_error" // VerdictNetworkError the archive could not be fetched, re-run to confirm. VerdictNetworkError = "network_error" )
Verdicts.
Variables ¶
var ErrNotPinned = errors.New("no pinned commit in the proxy info")
ErrNotPinned the Go module proxy does not know which commit the version was published from.
Functions ¶
func CheckTags ¶
func CheckTags(ctx context.Context, t *TagChecker, results []Result, concurrency int)
CheckTags fills Result.Tag for the yaegi plugins hosted on GitHub. Only those with dependencies are checked: plugin-service serves them from a GitHub zipball, the others come from the Go module proxy, already pinned.
func IsGitHubModule ¶
IsGitHubModule reports whether mod is a github.com/<owner>/<repo> module, the only ones CheckTags can check.
func SelectWarmup ¶
func SelectWarmup(ctx context.Context, t *TagChecker, entries []catalog.Entry, top, concurrency int) []catalog.Entry
SelectWarmup returns the latest recorded version of the top plugins by stars, plugins with dependencies first: they are served from GitHub, the slowest path.
Types ¶
type Change ¶
type Change struct {
Key string `json:"key"`
Before Result `json:"before"`
After Result `json:"after"`
}
Change is one entry of the first audit, compared with the second.
type Client ¶
type Client struct {
BaseURL string
Username string
Password string
UserAgent string
HTTP *http.Client
RetryWait time.Duration
}
Client probes a plugin service through its public endpoints.
func (*Client) Download ¶
Download fetches the archive and hashes it, retrying on network and server errors. On failure, Status is the last HTTP status received, 0 if none.
func (*Client) DownloadUncached ¶
DownloadUncached is Download with a unique query string, so the CDN forwards it to the plugin service.
type Diff ¶
type Diff struct {
// Regressions were OK and are not anymore, or are missing now.
Regressions []Change `json:"regressions"`
// Unchecked were OK and hit a network error now, re-run to confirm.
Unchecked []Change `json:"unchecked"`
// BytesChanged are OK on both sides but serve different bytes.
BytesChanged []Change `json:"bytesChanged"`
// Fixed were not OK and are now.
Fixed []Change `json:"fixed"`
// StillBroken are not OK on either side.
StillBroken []Change `json:"stillBroken"`
// Removed were audited before, not OK, and are missing now.
Removed []string `json:"removed"`
// Added are missing from the previous audit.
Added []string `json:"added"`
}
Diff compares two audits of the same catalog, keyed by module@version.
type Result ¶
type Result struct {
catalog.Entry
ServedHash string `json:"servedHash,omitempty"`
Size int64 `json:"size,omitempty"`
DownloadStatus int `json:"downloadStatus,omitempty"`
ValidateStatus int `json:"validateStatus,omitempty"`
CacheStatus string `json:"cacheStatus,omitempty"`
Verdict string `json:"verdict"`
Error string `json:"error,omitempty"`
Tag *TagCheck `json:"tag,omitempty"`
}
Result is the audit of one recorded hash.
type TagCheck ¶
type TagCheck struct {
ProxyCommit string `json:"proxyCommit,omitempty"`
TagCommit string `json:"tagCommit,omitempty"`
Moved bool `json:"moved"`
Error string `json:"error,omitempty"`
// NoDependencies the plugin is served from the Go module proxy, already pinned: nothing to check.
NoDependencies bool `json:"noDependencies,omitempty"`
}
TagCheck compares the commit a tag points at today with the one the Go module proxy pinned at publication.
type TagChecker ¶
TagChecker reads the Go module proxy and GitHub.
func NewTagChecker ¶
func NewTagChecker(goProxyURL string, gh *github.Client) *TagChecker
NewTagChecker creates a TagChecker using the Go module proxy at goProxyURL.
func (*TagChecker) Check ¶
func (t *TagChecker) Check(ctx context.Context, mod, version string) *TagCheck
Check compares the tag commit on GitHub with the Origin.Hash of the Go module proxy.
func (*TagChecker) Gone ¶
Gone reports whether module@version can no longer be fetched upstream, whatever plugin-service answers: the Go module proxy has no go.mod for it, or the GitHub ref plugin-service downloads it from does not exist. That ref is the commit pinned by the Go module proxy, the tag when there is none or for wasm plugins.
func (*TagChecker) HasDependencies ¶
HasDependencies reports whether the go.mod of module@version requires other modules.
func (*TagChecker) ProxyCommit ¶
ProxyCommit returns the commit pinned by the Go module proxy for module@version.
Source Files