mirror of
https://github.com/lima-vm/lima.git
synced 2026-10-28 19:54:35 +08:00
Akihiro Suda
c80fad98ad
gomodjail v2 moves the focus to static analysis: `gomodjail analyze` verifies that the modules annotated `gomodjail:confined` in go.mod cannot reach a denied capability (filesystem, network, process execution, raw syscalls, OS state modification, or cgo). Add gomodjail to ./hack/tools, add a `gomodjail` lint target, and wire it into `make lint` and the "Lints" job. Unlike the legacy dynamic mode, this gate is blocking. The verdicts are platform-dependent, so the gate is pinned to linux/amd64 and linux/arm64. These are the only platforms that can be analyzed from any host: analyzing darwin needs a macOS host, as the "vz" driver requires cgo. The linux verdicts are a superset of the darwin ones anyway. Windows is deliberately left out, as it would unconfine 18 more modules (go-yaml, containerd/log, go-runewidth, ...) and weaken the gate for the other platforms. `gomodjail fix` downgraded 36 modules to `gomodjail:unconfined` to make the gate pass. 65 modules remain confined: 37 clean, 28 warning-only. `make gomodjail-fix` is added for redoing this on dependency bumps, so that the decision stays visible and reviewable in go.mod. The macOS job that exercises the legacy dynamic mode (`gomodjail run`) is kept as an experiment, with its checkout pinned to v2.0.1 instead of HEAD. Assisted-by: Claude Code (Opus 5) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>