-
-
Notifications
You must be signed in to change notification settings - Fork 230
/
shared.go
307 lines (270 loc) · 8.62 KB
/
shared.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
package main
import (
"bytes"
"encoding/gob"
"encoding/json"
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"time"
"golang.org/x/mod/module"
)
// sharedCache is shared as a read-only cache between the many garble toolexec
// sub-processes.
//
// Note that we fill this cache once from the root process in saveListedPackages,
// store it into a temporary file via gob encoding, and then reuse that file
// in each of the garble toolexec sub-processes.
type sharedCache struct {
ExecPath string // absolute path to the garble binary being used
ForwardBuildFlags []string // build flags fed to the original "garble ..." command
// ListedPackages contains data obtained via 'go list -json -export -deps'.
// This allows us to obtain the non-obfuscated export data of all dependencies,
// useful for type checking of the packages as we obfuscate them.
ListedPackages map[string]*listedPackage
// We can't rely on the module version to exist,
// because it's missing in local builds without 'go install'.
// For now, use 'go tool buildid' on the garble binary.
// Just like Go's own cache, we use hex-encoded sha256 sums.
// Once https://github.com/golang/go/issues/37475 is fixed,
// we can likely just use that.
BinaryContentID []byte
GOGARBLE string
// Filled directly from "go env".
// Remember to update the exec call when adding or removing names.
GoEnv struct {
GOOS string // i.e. the GOOS build target
GOPRIVATE string
GOMOD string
GOVERSION string
GOCACHE string
}
}
var cache *sharedCache
// loadSharedCache the shared data passed from the entry garble process
func loadSharedCache() error {
if cache != nil {
panic("shared cache loaded twice?")
}
startTime := time.Now()
f, err := os.Open(filepath.Join(sharedTempDir, "main-cache.gob"))
if err != nil {
return fmt.Errorf(`cannot open shared file, this is most likely due to not running "garble [command]"`)
}
defer func() {
debugf("shared cache loaded in %s from %s", debugSince(startTime), f.Name())
}()
defer f.Close()
if err := gob.NewDecoder(f).Decode(&cache); err != nil {
return err
}
return nil
}
// saveSharedCache creates a temporary directory to share between garble processes.
// This directory also includes the gob-encoded cache global.
func saveSharedCache() (string, error) {
if cache == nil {
panic("saving a missing cache?")
}
dir, err := os.MkdirTemp("", "garble-shared")
if err != nil {
return "", err
}
sharedCache := filepath.Join(dir, "main-cache.gob")
if err := writeGobExclusive(sharedCache, &cache); err != nil {
return "", err
}
return dir, nil
}
func createExclusive(name string) (*os.File, error) {
return os.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o666)
}
// TODO(mvdan): consider using proper atomic file writes.
// Or possibly even "lockedfile", mimicking cmd/go.
func writeFileExclusive(name string, data []byte) error {
f, err := createExclusive(name)
if err != nil {
return err
}
_, err = f.Write(data)
if err2 := f.Close(); err == nil {
err = err2
}
return err
}
func writeGobExclusive(name string, val interface{}) error {
f, err := createExclusive(name)
if err != nil {
return err
}
if err := gob.NewEncoder(f).Encode(val); err != nil {
return err
}
if err2 := f.Close(); err == nil {
err = err2
}
return err
}
// listedPackage contains the 'go list -json -export' fields obtained by the
// root process, shared with all garble sub-processes via a file.
type listedPackage struct {
Name string
ImportPath string
ForTest string
Export string
BuildID string
Deps []string
ImportMap map[string]string
Standard bool
Dir string
GoFiles []string
Imports []string
// The fields below are not part of 'go list', but are still reused
// between garble processes. Use "Garble" as a prefix to ensure no
// collisions with the JSON fields from 'go list'.
GarbleActionID []byte
ToObfuscate bool
}
func (p *listedPackage) obfuscatedImportPath() string {
if p.Name == "main" || p.ImportPath == "embed" || !p.ToObfuscate {
return p.ImportPath
}
newPath := hashWith(p.GarbleActionID, p.ImportPath)
debugf("import path %q hashed with %x to %q", p.ImportPath, p.GarbleActionID, newPath)
return newPath
}
// appendListedPackages gets information about the current package
// and all of its dependencies
func appendListedPackages(patterns ...string) error {
startTime := time.Now()
// TODO: perhaps include all top-level build flags set by garble,
// including -buildvcs=false.
// They shouldn't affect "go list" here, but might as well be consistent.
args := []string{"list", "-json", "-deps", "-export", "-trimpath"}
args = append(args, cache.ForwardBuildFlags...)
args = append(args, patterns...)
cmd := exec.Command("go", args...)
defer func() {
debugf("original build info obtained in %s via: go %s", debugSince(startTime), strings.Join(args, " "))
}()
stdout, err := cmd.StdoutPipe()
if err != nil {
return err
}
var stderr bytes.Buffer
cmd.Stderr = &stderr
if err := cmd.Start(); err != nil {
return fmt.Errorf("go list error: %v", err)
}
dec := json.NewDecoder(stdout)
if cache.ListedPackages == nil {
cache.ListedPackages = make(map[string]*listedPackage)
}
for dec.More() {
var pkg listedPackage
if err := dec.Decode(&pkg); err != nil {
return err
}
if pkg.Export != "" {
actionID := decodeHash(splitActionID(pkg.BuildID))
pkg.GarbleActionID = addGarbleToHash(actionID)
}
cache.ListedPackages[pkg.ImportPath] = &pkg
}
if err := cmd.Wait(); err != nil {
return fmt.Errorf("go list error: %v: %s", err, stderr.Bytes())
}
anyToObfuscate := false
for path, pkg := range cache.ListedPackages {
// If "GOGARBLE=foo/bar", "foo/bar_test" should also match.
if pkg.ForTest != "" {
path = pkg.ForTest
}
// Test main packages like "foo/bar.test" are always obfuscated,
// just like main packages.
if (pkg.Name == "main" && strings.HasSuffix(path, ".test")) || toObfuscate(path) {
pkg.ToObfuscate = true
anyToObfuscate = true
}
}
// Don't error if the user ran: GOGARBLE='*' garble build runtime
if !anyToObfuscate && !module.MatchPrefixPatterns(cache.GOGARBLE, "runtime") {
return fmt.Errorf("GOGARBLE=%q does not match any packages to be built", cache.GOGARBLE)
}
return nil
}
var listedRuntimeLinknamed = false
// listPackage gets the listedPackage information for a certain package
func listPackage(path string) (*listedPackage, error) {
if path == curPkg.ImportPath {
return curPkg, nil
}
// If the path is listed in the top-level ImportMap, use its mapping instead.
// This is a common scenario when dealing with vendored packages in GOROOT.
// The map is flat, so we don't need to recurse.
if path2 := curPkg.ImportMap[path]; path2 != "" {
path = path2
}
pkg, ok := cache.ListedPackages[path]
// The runtime may list any package in std, even those it doesn't depend on.
// This is due to how it linkname-implements std packages,
// such as sync/atomic or reflect, without importing them in any way.
// If ListedPackages lacks such a package we fill it with "std".
if curPkg.ImportPath == "runtime" {
if ok {
return pkg, nil
}
if listedRuntimeLinknamed {
panic(fmt.Sprintf("package %q still missing after go list call", path))
}
startTime := time.Now()
// Obtained via scripts/runtime-linknamed-nodeps.sh as of Go 1.18beta1.
runtimeLinknamed := []string{
"crypto/x509/internal/macos",
"net",
"os/signal",
"plugin",
"runtime/debug",
"runtime/metrics",
"runtime/pprof",
"runtime/trace",
"syscall/js",
}
var missing []string
for _, linknamed := range runtimeLinknamed {
switch {
case cache.ListedPackages[linknamed] != nil:
// We already have it; skip.
case cache.GoEnv.GOOS != "js" && linknamed == "syscall/js":
// GOOS-specific package.
case cache.GoEnv.GOOS != "darwin" && linknamed == "crypto/x509/internal/macos":
// GOOS-specific package.
default:
missing = append(missing, linknamed)
}
}
if err := appendListedPackages(missing...); err != nil {
panic(err) // should never happen
}
pkg, ok := cache.ListedPackages[path]
if !ok {
panic(fmt.Sprintf("runtime listed a std package we can't find: %s", path))
}
listedRuntimeLinknamed = true
debugf("listed %d missing runtime-linknamed packages in %s", len(missing), debugSince(startTime))
return pkg, nil
}
// Packages other than runtime can list any package,
// as long as they depend on it directly or indirectly.
if !ok {
return nil, fmt.Errorf("path not found in listed packages: %s", path)
}
for _, dep := range curPkg.Deps {
if dep == pkg.ImportPath {
return pkg, nil
}
}
return nil, fmt.Errorf("refusing to list non-dependency package: %s", path)
}