branderson
7249da8fc3
Installs the latest stable Go release, fetched and verified the same way as gosu: go.dev's own release JSON gives both the download URL and a SHA256 per file, checked before extracting since this runs as root. Also allowlists proxy.golang.org and sum.golang.org (Go's module proxy and checksum database) - go build/go mod download need them reachable at runtime, same as registry.npmjs.org/pypi.org for npm/pip. Verified end to end: go version, and a real `go mod tidy` + `go run` against an actual module (rsc.io/quote, pulling in transitive dependencies) through the real firewall - not just that the binary installs. All 25 existing tests still pass.
27 lines
998 B
Bash
27 lines
998 B
Bash
# Sourced by both init-firewall.sh (IP-based ipset allowlist) and
|
|
# dns-proxy.sh (name-based DNS allowlist) so the two can't drift apart.
|
|
FIXED_DOMAINS=(
|
|
"registry.npmjs.org"
|
|
"api.anthropic.com"
|
|
"gitlab.com"
|
|
"pypi.org"
|
|
"files.pythonhosted.org"
|
|
"release-assets.githubusercontent.com"
|
|
"proxy.golang.org"
|
|
"sum.golang.org"
|
|
)
|
|
|
|
# GitHub itself is allowlisted by IP range (see github-domains ipset,
|
|
# populated from api.github.com/meta), never by resolving these names to
|
|
# specific IPs - but the container's own tools (git, gh, curl) still need to
|
|
# resolve these names to *something* before connecting, so the DNS proxy
|
|
# needs to know they're allowed even though init-firewall.sh never digs them.
|
|
# Suffix matching means these also cover their actual subdomains in use
|
|
# (api.github.com, codeload.github.com, objects.githubusercontent.com, etc.)
|
|
# without enumerating each one.
|
|
GITHUB_DNS_SUFFIXES=(
|
|
"github.com"
|
|
"githubusercontent.com"
|
|
"githubassets.com"
|
|
)
|