Modified goreleaser.yml for making reproducible builds

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )

.goreleaser.yml

@@ -14,6 +14,13 @@ builds:
  goarch:
  - amd64
 
+ mod_timestamp: '123'
+ flags:
+ - -trimpath
+ ldflags:
+ - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date=123
+
+
  # Optionally override the matrix generation and specify only the final list of targets.
  # Format is `{goos}_{goarch}` with optionally a suffix with `_{goarm}` or `_{gomips}`.
  # This overrides `goos`, `goarch`, `goarm`, `gomips` and `ignores`.

eventhandler.go

@@ -18,17 +18,18 @@ import (
 )
 
 type EventHandler struct {
-	CorrelationId string
-	Repo string
-	ApiClient *ApiClient
-	DNSProxy *DNSProxy
-	ProcessConnectionMap map[string]bool
-	ProcessFileMap map[string]bool
-	ProcessMap map[string]*Process
-	SourceCodeMap map[string][]*Event
-	netMutex sync.RWMutex
-	fileMutex sync.RWMutex
-	procMutex sync.RWMutex
+	CorrelationId string
+	Repo string
+	ApiClient *ApiClient
+	DNSProxy *DNSProxy
+	ProcessConnectionMap map[string]bool
+	ProcessFileMap map[string]bool
+	ProcessMap map[string]*Process
+	SourceCodeMap map[string][]*Event
+	FileOverwriteCounterMap map[string]int // to count file overwrites by an exe
+	netMutex sync.RWMutex
+	fileMutex sync.RWMutex
+	procMutex sync.RWMutex
 }
 
 var classAPrivateSubnet, classBPrivateSubnet, classCPrivateSubnet, loopBackSubnet, ipv6LinkLocalSubnet, ipv6LocalSubnet *net.IPNet
@@ -48,6 +49,9 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  writeDone()
 	}
 
+	// Uncomment to log file writes (only uncomment in INT env)
+	// WriteLog(fmt.Sprintf("file write %s, syscall %s", event.FileName, event.Syscall))
+
 	_, found := eventHandler.ProcessFileMap[event.Pid]
 	fileType := ""
 	if !found {
@@ -66,7 +70,7 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
  }
 	}
 
-	if isSourceCodeFile(event.FileName) && !isSyscallExcluded(event.Syscall) {
+	if isSourceCodeFile(event.FileName) {
  _, found = eventHandler.SourceCodeMap[event.FileName]
  if !found {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
@@ -81,28 +85,31 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
 
  if isFromDifferentProcess {
  eventHandler.SourceCodeMap[event.FileName] = append(eventHandler.SourceCodeMap[event.FileName], event)
- WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten %s syscall: %s by %s", event.FileName, event.Syscall, event.Exe))
+ if !strings.Contains(event.FileName, "node_modules/") { // node_modules folder has overwrites by design, even has .cs files in some cases. Need a better way to handle that
+ counter, found := eventHandler.FileOverwriteCounterMap[event.Exe]
+ if !found || counter < 3 {
+ checksum, err := getProgramChecksum(event.Exe)
+ if err == nil {
+ WriteLog(fmt.Sprintf("[Source code overwritten] file: %s syscall: %s by exe: %s [%s] Timestamp: %s", event.FileName, event.Syscall, event.Exe, checksum, event.Timestamp.Format("2006-01-02T15:04:05.999999999Z")))
+ WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Source code overwritten file: %s syscall: %s by exe: %s", event.FileName, event.Syscall, event.Exe))
+ }
+
+ eventHandler.FileOverwriteCounterMap[event.Exe]++
+ }
+ }
  }
  }
 	}
 
 	eventHandler.fileMutex.Unlock()
 }
 
-func isSyscallExcluded(syscall string) bool {
-	if syscall == "chmod" || syscall == "unlink" || syscall == "unlinkat" {
- return true
-	}
-
-	return false
-}
-
 func isSourceCodeFile(fileName string) bool {
 	ext := path.Ext(fileName)
 	// https://docs.github.com/en/get-started/learning-about-github/github-language-support
 	// TODO: Add js & ts back. node makes change to js files as part of downloading/ setting up dependencies
 	// TODO: Add more extensions
-	sourceCodeExtensions := []string{".c", "cpp", "cs", ".go", ".java"}
+	sourceCodeExtensions := []string{".c", ".cpp", ".cs", ".go", ".java"}
 	for _, extension := range sourceCodeExtensions {
  if ext == extension {
  return true

go.mod

@@ -8,61 +8,39 @@ require (
 	github.com/florianl/go-nflog/v2 v2.0.1
 	github.com/google/gopacket v1.1.19
 	github.com/jarcoal/httpmock v1.0.8
-	github.com/miekg/dns v1.1.45
+	github.com/miekg/dns v1.1.48
 	github.com/pkg/errors v0.9.1
 )
 
 require (
-	github.com/BurntSushi/toml v1.0.0 // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Microsoft/hcsshim v0.8.23 // indirect
-	github.com/bits-and-blooms/bitset v1.2.0 // indirect
-	github.com/containerd/cgroups v1.0.1 // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/containerd/fifo v1.0.0 // indirect
-	github.com/containerd/ttrpc v1.1.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/containerd/containerd v1.6.2 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
-	github.com/klauspost/compress v1.11.13 // indirect
-	github.com/mdlayher/socket v0.1.1 // indirect
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/mountinfo v0.4.1 // indirect
+	github.com/josharian/native v1.0.0 // indirect
+	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
-	github.com/opencontainers/selinux v1.8.2 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.22.3 // indirect
-	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/grpc v1.43.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	honnef.co/go/tools v0.2.2 // indirect
+	golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
+	google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 )
 
 require (
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/mdlayher/netlink v1.5.0 // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
+	github.com/docker/docker v20.10.14+incompatible
+	github.com/google/go-cmp v0.5.7 // indirect
+	github.com/mdlayher/netlink v1.6.0 // indirect
+	golang.org/x/net v0.0.0-20220421235706-1d1ef9303861 // indirect
+	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
 )