NAME
glab-dependency-firewall-go - Run go through the GitLab Dependency Firewall. (BETA)
SYNOPSIS
glab dependency-firewall go [flags]
DESCRIPTION
Run the go binary through the GitLab Dependency Firewall. The command checks each module download against the policy for the current project, refuses blocked modules, and summarizes the results after the run.
Module downloads go through a Go module proxy that the command starts on 127.0.0.1 for the run. No certificate is involved, so your system trust store is not changed.
For the run, GOPROXY points at that proxy, GONOPROXY is none, and GO111MODULE is on, so every module download is checked. Private modules matched by GOPRIVATE are also checked, then fetched the way your configuration fetches them.
If you set GOPROXY=off, the command keeps it. If you set GOPROXY to any other non-default value, the command stops before it runs go.
The command checks only modules that go downloads during the run:
- •
-
Modules already in your module cache are not checked. In CI, point GOMODCACHE at an empty directory to check every module.
- •
-
Vendored code and replace directives that point at a local path are not checked.
- •
-
Go toolchain downloads are not checked by policy. go verifies them against the checksum database.
Module paths and versions, including private ones, are sent to the policy API and written to .gitlab/df/ci-log.json. CI jobs that upload that file publish them with the job's artifacts.
Tests that make HTTPS requests can fail certificate checks under this command. Run go test outside the firewall if your tests reach the network.
All arguments are forwarded to go verbatim.
This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/.
OPTIONS INHERITED FROM PARENT COMMANDS
-h, --help[=false]
Show help for this command.
EXAMPLE
# Download modules through the Dependency Firewall glab dependency-firewall go mod download # Add a dependency, checking it against the policy first glab dependency-firewall go get github.com/pkg/[email protected]