glab dependency-firewall go

Run go through the GitLab Dependency Firewall. (BETA)

Synopsis

Run the go binary through the GitLab Dependency Firewall. The command checks each module download against the policy for the current project, refuses blocked modules, and summarizes the results after the run.

Module downloads go through a Go module proxy that the command starts on 127.0.0.1 for the run. No certificate is involved, so your system trust store is not changed.

For the run, GOPROXY points at that proxy, GONOPROXY is none, and GO111MODULE is on, so every module download is checked. Private modules matched by GOPRIVATE are also checked, then fetched the way your configuration fetches them.

If you set GOPROXY=off, the command keeps it.

Allowed modules are downloaded through your configured GOPROXY, from the environment or the go env file, in list order and with its fallbacks. Credentials for that proxy come from your .netrc file, GOAUTH, or the URL itself. A GOSUMDB with its own URL is reached through the proxy the command starts; credentials for that URL must be in the URL itself, because .netrc and GOAUTH apply only to GOPROXY.

The command checks only modules that go downloads during the run:

  • Modules already in your module cache are not checked. In CI, point GOMODCACHE at an empty directory to check every module.
  • Vendored code and replace directives that point at a local path are not checked.
  • Go toolchain downloads are not checked by policy. go verifies them against the checksum database.

Module paths and versions, including private ones, are sent to the policy API and written to .gitlab/df/ci-log.json. CI jobs that upload that file publish them with the job’s artifacts.

Tests that make HTTPS requests can fail certificate checks under this command. Run go test outside the firewall if your tests reach the network.

All arguments are forwarded to go verbatim.

This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/.

glab dependency-firewall go <go args> [flags]

Examples

console
# Download modules through the Dependency Firewall
glab dependency-firewall go mod download

# Add a dependency, checking it against the policy first
glab dependency-firewall go get github.com/pkg/errors@v0.9.1

Environment variables

HTTPS_PROXY: outbound proxy glab uses to reach package registries. Credentials in the URL are sent to the proxy.
NO_PROXY: hosts glab reaches directly instead of through HTTPS_PROXY.

Options inherited from parent commands

  -h, --help   Show help for this command.