acquire

Documentation

Overview

Package acquire prepares an isolated workspace for an SCA target. The artifact is fetched/validated and only ever read, never executed.

Scope + authorization-window enforcement happens in the SCA use case BEFORE Acquire is called; this package assumes the target was authorized.

Index

• Constants
• type Acquirer
  • func New() *Acquirer
  • func (a *Acquirer) Acquire(ctx context.Context, req ports.AcquireRequest) (*ports.Workspace, error)
  • func (a *Acquirer) WithComparisonDepth(depth int) *Acquirer
  • func (a *Acquirer) WithImageRootFS(enabled bool) *Acquirer
  • func (a *Acquirer) WithImageTool(bin string) *Acquirer
  • func (a *Acquirer) WithMaxWorkspaceBytes(n int64) *Acquirer
  • func (a *Acquirer) WithSandbox(r ports.ToolRunner, egressScoped bool) *Acquirer

Constants

const MaxWorkspaceBytes = 2 << 30 // 2 GiB

MaxWorkspaceBytes caps the total size of a prepared workspace. Configurable per-engagement later; a const backstop for now.

Types

type Acquirer

type Acquirer struct {
	// contains filtered or unexported fields
}

Acquirer prepares isolated workspaces for SCA targets.

func New

func New() *Acquirer

New returns a new Acquirer.

func (*Acquirer) Acquire

func (a *Acquirer) Acquire(ctx context.Context, req ports.AcquireRequest) (*ports.Workspace, error)

Acquire dispatches on the target kind. local is scanned in place; git is shallow-cloned into a temp workspace that is cleaned up after the scan.

func (*Acquirer) WithComparisonDepth

func (a *Acquirer) WithComparisonDepth(depth int) *Acquirer

WithComparisonDepth bounds Git history fetched for immutable Code comparisons. A non-positive value retains the conservative default.

func (*Acquirer) WithImageRootFS

func (a *Acquirer) WithImageRootFS(enabled bool) *Acquirer

WithImageRootFS makes an image pull ALSO materialize the assembled root filesystem from the OCI layout (layers applied with whiteouts) into the workspace, exposed on Workspace.RootFS, so owned parsers can read on-disk OS-package DBs and /etc/os-release. Off by default (extra disk + time); wired from SYNAPSE_IMAGE_ROOTFS_ENABLED at the composition root.

func (*Acquirer) WithImageTool

func (a *Acquirer) WithImageTool(bin string) *Acquirer

WithImageTool overrides the crane binary used for container-image acquisition.

func (*Acquirer) WithMaxWorkspaceBytes

func (a *Acquirer) WithMaxWorkspaceBytes(n int64) *Acquirer

WithMaxWorkspaceBytes overrides the prepared-workspace size cap (wired from SYNAPSE_MAX_WORKSPACE_BYTES at the composition root). A value <= 0 is ignored, so the MaxWorkspaceBytes default (2 GiB) stands. Lower it to fail fast in CI; raise it for a legitimately large monorepo. The same cap also bounds archive extraction (bomb guard).

func (*Acquirer) WithSandbox

func (a *Acquirer) WithSandbox(r ports.ToolRunner, egressScoped bool) *Acquirer

WithSandbox makes git clone + image pull ALWAYS run inside the sandbox (F4) – caps dropped, seccomp-filtered, curated read-only FS, cgroup-limited, workspace the only writable path – so a hostile repo/server/hook/image cannot touch the host or read its secrets. egressScoped selects the network posture: true confines the fetch to a netns whose egress is DNS-pinned to the repo/registry host (needs CAP_NET_ADMIN); false shares the host network un-scoped (still fully sandboxed otherwise) for an unprivileged deployment that cannot build a netns. A nil runner is the only path that execs directly.