guard: the four ways out of this program that need no import of net - #51
Merged
Conversation
Asked for by the owner, after a test their sister project wrote. That one is Python, where an alias defeats a static scan and a PEP 578 audit hook has to make up the difference. Both of those halves already exist here and are stronger: network_test.go reads our import lines, clinetwork_test.go asks the compiler what the command line binary links, and in Go an import statement carries the real path whatever the file calls it locally - so there is no alias problem to solve. What neither of them can see is that reaching a network does not need Go's networking at all. Four ways, none of which shows up as an import of net: An address written into the code. A string is not an import. A library loaded by name. internal/gui reaches uxtheme.dll through syscall.NewLazyDLL and calls it by ordinal, which is wanted and documented - and it is the same shape that would load wininet.dll instead. A socket opened under the import graph. syscall is legitimately imported in eight shipped files for disk space, signals and the dark menu, so banning it is not available. Naming the socket shaped calls is. Shelling out. curl needs no networking package, and the os/exec ban in network_test.go stops at layer 2 - internal/cli is layer 4 and cmd/tfg is layer 5, so neither was covered by anything. MEASURED: cmd/tfg links os/exec zero times and cmd/tfg-gui once, through the toolkit that opens the support page on a click. This holds the command line at what it already is. Two registries carry the exceptions, each with its reason, each exact in both directions - an unlisted use fails and a listed one whose code is gone fails too. Scope is what the compiler says ships, 45 packages, so oracle and site are out. Within those it reads every .go file INCLUDING the ones this system does not build: build.ImportDir honours the build context, so a guard reading only its own platform would let an endpoint into the other one. 158 files. The negative result is written down rather than left to be found: this is no proof that no traffic leaves the machine. It is a lock on the surface. And it caught a fault in itself before anything else did. The first version asked whether a literal STARTED with a scheme, so an address inside a longer string walked through - which is how every XML namespace in this tree is written. Thirteen canary cases missed it because every one of them put the address on its own. What found it was the staleness half, reporting three registered namespaces as gone. That bug is now a mutation. Nine mutations, all caught. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Asked for by the owner, after a test their sister project wrote (
test_no_telemetry.py). This is not a port of it.That one is Python, where
import socket as sdefeats a static scan and a PEP 578 audit hook has to make up the difference. Both halves already exist here and are stronger:network_test.goreads our import lines,clinetwork_test.goasks the compiler what the command line binary links, and in Go animportstatement carries the real path whatever the file calls it locally - so there is no alias problem to solve.What neither of them can see
Reaching a network needs no Go networking at all. Four ways, none of which shows up as an import of
net:internal/guireachesuxtheme.dllviasyscall.NewLazyDLLand calls it by ordinal - wanted, documented, and the same shape that would loadwininet.dllsyscallis legitimately imported in eight shipped files, so banning it is not available - naming the socket shaped calls iscurlneeds no networking package, and theos/execban stops at layer 2 whileinternal/cliis layer 4 andcmd/tfgis layer 5Measured:
cmd/tfglinksos/execzero times andcmd/tfg-guionce, through the toolkit that opens the support page on a click. So this holds the command line at what it already is, and does not pretend the window is the same sentence - untouchable rule 8 says handing an address to the system browser is not the program connecting to anything.Scope
Two registries carry the exceptions, each with its reason, each exact in both directions: an unlisted use fails, and a listed one whose code is gone fails too.
The scope is what the compiler says ships (45 packages, so
oracleandsiteare out). Within those it reads every.gofile including the ones this system does not build -build.ImportDirhonours the build context, so a guard reading only its own platform would let an endpoint into the other one. 158 files.What it does not prove, said in the file rather than left to be found
A URL assembled at runtime. What a third party module links (a separate sentence, already written). Data leaving without a socket. This is no proof that no traffic leaves the machine - it is a lock on the surface.
It caught a fault in itself first
The first version asked whether a literal started with a scheme, so an address inside a longer string walked through - which is how every XML namespace in this tree is written. Thirteen canary cases missed it, because every one of them put the address on its own. What found it was the staleness half, reporting three registered namespaces as gone. That bug is now a mutation.
Nine mutations, all caught. Full suite green,
preflight --quickgreen on all twelve checks.🤖 Generated with Claude Code