audit

package
v0.29.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 29, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Overview

Package audit checks that the archive served for each plugin version matches its recorded hash.

Index

Constants

View Source 
const (
	// VerdictOK the served archive matches the recorded hash and validate accepts it.
	VerdictOK = "ok"
	// VerdictMismatch the served archive does not match the recorded hash.
	VerdictMismatch = "mismatch"
	// VerdictValidateFailed the served archive matches the recorded hash but validate rejects it.
	VerdictValidateFailed = "validate_failed"
	// VerdictDownloadError the archive is not served.
	VerdictDownloadError = "download_error"
	// VerdictNetworkError the archive could not be fetched, re-run to confirm.
	VerdictNetworkError = "network_error"
)

Verdicts.

Variables

View Source 
var ErrNotPinned = errors.New("no pinned commit in the proxy info")

ErrNotPinned the Go module proxy does not know which commit the version was published from.

Functions

func CheckTags 

func CheckTags(ctx context.Context, t *TagChecker, results []Result, concurrency int)

CheckTags fills Result.Tag for the yaegi plugins hosted on GitHub. Only those with dependencies are checked: plugin-service serves them from a GitHub zipball, the others come from the Go module proxy, already pinned.

func IsGitHubModule 

func IsGitHubModule(mod string) bool

IsGitHubModule reports whether mod is a github.com/<owner>/<repo> module, the only ones CheckTags can check.

func SelectWarmup 

func SelectWarmup(ctx context.Context, t *TagChecker, entries []catalog.Entry, top, concurrency int) []catalog.Entry

SelectWarmup returns the latest recorded version of the top plugins by stars, plugins with dependencies first: they are served from GitHub, the slowest path.

func WriteDiff 

func WriteDiff(w io.Writer, d Diff)

WriteDiff writes a markdown summary of a Diff.

func WriteReport 

func WriteReport(w io.Writer, baseURL string, results []Result)

WriteReport writes a markdown summary of an audit.

Types

type Change 

type Change struct {
	Key    string `json:"key"`
	Before Result `json:"before"`
	After  Result `json:"after"`
}

Change is one entry of the first audit, compared with the second.

type Client 

type Client struct {
	BaseURL   string
	Username  string
	Password  string
	UserAgent string
	HTTP      *http.Client
	RetryWait time.Duration
}

Client probes a plugin service through its public endpoints.

func NewClient 

func NewClient(baseURL, username, password string) *Client

NewClient creates a client for the plugin service at baseURL.

func (*Client) Download 

func (c *Client) Download(ctx context.Context, module, version string) (Download, error)

Download fetches the archive and hashes it, retrying on network and server errors. On failure, Status is the last HTTP status received, 0 if none.

func (*Client) DownloadUncached 

func (c *Client) DownloadUncached(ctx context.Context, module, version string) (Download, error)

DownloadUncached is Download with a unique query string, so the CDN forwards it to the plugin service.

func (*Client) Validate 

func (c *Client) Validate(ctx context.Context, module, version, hash string) (int, error)

Validate calls the validate endpoint with hash and returns the status code, retrying on network and server errors. A server error left after the retries is returned as an error.

type Diff 

type Diff struct {
	// Regressions were OK and are not anymore, or are missing now.
	Regressions []Change `json:"regressions"`
	// Unchecked were OK and hit a network error now, re-run to confirm.
	Unchecked []Change `json:"unchecked"`
	// BytesChanged are OK on both sides but serve different bytes.
	BytesChanged []Change `json:"bytesChanged"`
	// Fixed were not OK and are now.
	Fixed []Change `json:"fixed"`
	// StillBroken are not OK on either side.
	StillBroken []Change `json:"stillBroken"`
	// Removed were audited before, not OK, and are missing now.
	Removed []string `json:"removed"`
	// Added are missing from the previous audit.
	Added []string `json:"added"`
}

Diff compares two audits of the same catalog, keyed by module@version.

func Compare 

func Compare(before, after []Result) Diff

Compare diffs before and after.

type Download 

type Download struct {
	Status      int
	CacheStatus string
	Hash        string
	Size        int64
}

Download is the outcome of one archive download.

type Result 

type Result struct {
	catalog.Entry

	ServedHash     string `json:"servedHash,omitempty"`
	Size           int64  `json:"size,omitempty"`
	DownloadStatus int    `json:"downloadStatus,omitempty"`
	ValidateStatus int    `json:"validateStatus,omitempty"`
	CacheStatus    string `json:"cacheStatus,omitempty"`
	Verdict        string `json:"verdict"`
	Error          string `json:"error,omitempty"`

	Tag *TagCheck `json:"tag,omitempty"`
}

Result is the audit of one recorded hash.

func Run 

func Run(ctx context.Context, c *Client, entries []catalog.Entry, concurrency int) []Result

Run audits entries with the given concurrency. Results keep the order of entries.

func Warmup 

func Warmup(ctx context.Context, c *Client, entries []catalog.Entry, concurrency int) []Result

Warmup downloads each archive once, so the CDN caches it.

type TagCheck 

type TagCheck struct {
	ProxyCommit string `json:"proxyCommit,omitempty"`
	TagCommit   string `json:"tagCommit,omitempty"`
	Moved       bool   `json:"moved"`
	Error       string `json:"error,omitempty"`
	// NoDependencies the plugin is served from the Go module proxy, already pinned: nothing to check.
	NoDependencies bool `json:"noDependencies,omitempty"`
}

TagCheck compares the commit a tag points at today with the one the Go module proxy pinned at publication.

type TagChecker 

type TagChecker struct {
	GoProxyURL string
	HTTP       *http.Client
	GitHub     *github.Client
}

TagChecker reads the Go module proxy and GitHub.

func NewTagChecker 

func NewTagChecker(goProxyURL string, gh *github.Client) *TagChecker

NewTagChecker creates a TagChecker using the Go module proxy at goProxyURL.

func (*TagChecker) Check 

func (t *TagChecker) Check(ctx context.Context, mod, version string) *TagCheck

Check compares the tag commit on GitHub with the Origin.Hash of the Go module proxy.

func (*TagChecker) Gone 

func (t *TagChecker) Gone(ctx context.Context, entry catalog.Entry) (bool, error)

Gone reports whether module@version can no longer be fetched upstream, whatever plugin-service answers: the Go module proxy has no go.mod for it, or the GitHub ref plugin-service downloads it from does not exist. That ref is the commit pinned by the Go module proxy, the tag when there is none or for wasm plugins.

func (*TagChecker) HasDependencies 

func (t *TagChecker) HasDependencies(ctx context.Context, mod, version string) (bool, error)

HasDependencies reports whether the go.mod of module@version requires other modules.

func (*TagChecker) ProxyCommit 

func (t *TagChecker) ProxyCommit(ctx context.Context, mod, version string) (string, error)

ProxyCommit returns the commit pinned by the Go module proxy for module@version.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.