Allow access to go internal modules

[KacperMalachowski]

Description

Changes proposed in this pull request:

• Add option to setup access to go internal modules, while using ADO backend

[dekiel]

Can we mount .netrc file always? If user would like to use it, they must copy it from build context to the image $HOME directory. This additional parameter would be not needed then.

[KacperMalachowski]

Can we mount .netrc file always? If user would like to use it, they must copy it from build context to the image $HOME directory. This additional parameter would be not needed then.

In theory yes, but I prefer not.
Implicitly changing the build context content doesn't look right for me.

Also putting it always allows malicious actors to get it from any kyma module through PR with a crafted Dockerfile. In the proposed setup only kyma modules which explicitly enabled this option are somehow vulnerable (that reduces the attack surface to mostly or even only modules hosted on internal GitHub).

Another option would be to implement the check that will fail the pipeline if . netrc was mentioned with e.g. cat command.

[dekiel]

You're right requiring to explicitly enable access to private modules would be safer. Trying to prevent printing .netrc or private module content seems not efficient, there is probably many ways to print the content. It would be hard to address all of them.

I'm thinking how we can secure the .netrc file further. If we would run go mod vendor before the build step, then the content of private modules will be accessible from vendor directory, but the .netrc. file will not be present in build context. This way users will not have access to the credentials stored in a file. What's your opinion?

[KacperMalachowski]

@dekiel That sounds good to me. I wasn't aware of go mod vendor to be honest, but the quick research looks promising.
With that approach we can drop the parameter as well.

[dekiel]

The parameter could stay. This way our private code wont be always accessible in build process and the user will have choice if use a go mod vendor or let go build get modules. I wasn't using go mod vendor much. We can test this approach for scenarios requiring private modules and later consider changing an image builder to always use it.

[dekiel]

Please add test for SetUseGoInternalModules function.