ci: confine dependencies with gomodjail (static mode)

.github/workflows/validate.yml

@@ -109,3 +109,41 @@ jobs:
         working-directory: ${{ github.workspace }}/src/github.com/docker/cli
         run: |
           make -C ./internal/gocompat verify
+
+  # check that dependencies confined in vendor.mod cannot reach privileged
+  # capabilities (file, network, exec, syscall, ...), using gomodjail in
+  # static mode. see the comment at the top of vendor.mod.
+  validate-gomodjail:
+    runs-on: ubuntu-26.04
+    env:
+      GOMODJAIL_VERSION: v2.0.1
+    strategy:
+      fail-fast: false
+      matrix:
+        goos:
+          - linux
+          - darwin
+        # windows is not checked yet, as the analysis reports false
+        # positives inside the Go standard library on windows.
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      -
+        name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.9"
+          cache: false
+      -
+        name: Install gomodjail
+        run: |
+          go install "github.com/AkihiroSuda/gomodjail/v2/cmd/gomodjail@${GOMODJAIL_VERSION}"
+      -
+        name: Run gomodjail
+        env:
+          GOOS_TARGET: ${{ matrix.goos }}
+        run: |
+          scripts/with-go-mod.sh gomodjail analyze --goos="${GOOS_TARGET}" --goarch=amd64 ./...

vendor.mod

@@ -1,3 +1,4 @@
+// gomodjail:confined
 module github.com/docker/cli
 
 // 'vendor.mod' enables use of 'go mod vendor' to managed 'vendor/' directory.
@@ -15,57 +16,57 @@ require (
 	dario.cat/mergo v1.0.2
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/errdefs/pkg v0.3.0
-	github.com/containerd/log v0.2.0
-	github.com/containerd/platforms v1.0.0-rc.5
+	github.com/containerd/log v0.2.0 // gomodjail:unconfined
+	github.com/containerd/platforms v1.0.0-rc.5 // gomodjail:unconfined
 	github.com/creack/pty v1.1.24
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli-docs-tool v0.11.0
-	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker-credential-helpers v0.9.9
-	github.com/docker/go-connections v0.8.2
+	github.com/docker/distribution v2.8.3+incompatible // gomodjail:unconfined
+	github.com/docker/docker-credential-helpers v0.9.9 // gomodjail:unconfined
+	github.com/docker/go-connections v0.8.2 // gomodjail:unconfined
 	github.com/docker/go-units v0.5.0
 	github.com/fvbommel/sortorder v1.2.0
 	github.com/go-jose/go-jose/v4 v4.1.5
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/go-cmp v0.7.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
-	github.com/google/uuid v1.6.0
+	github.com/google/uuid v1.6.0 // gomodjail:unconfined
 	github.com/mattn/go-runewidth v0.0.31
-	github.com/moby/go-archive v0.3.3
+	github.com/moby/go-archive v0.3.3 // gomodjail:unconfined
 	github.com/moby/moby/api v1.56.1
-	github.com/moby/moby/client v0.6.2
+	github.com/moby/moby/client v0.6.2 // gomodjail:unconfined
 	github.com/moby/patternmatcher v0.6.1
-	github.com/moby/swarmkit/v2 v2.1.2
-	github.com/moby/sys/atomicwriter v0.1.0
-	github.com/moby/sys/capability v0.4.0
-	github.com/moby/sys/sequential v0.7.0
-	github.com/moby/sys/signal v0.7.1
-	github.com/moby/sys/symlink v0.3.0
-	github.com/moby/term v0.5.2
+	github.com/moby/swarmkit/v2 v2.1.2 // gomodjail:unconfined
+	github.com/moby/sys/atomicwriter v0.1.0 // gomodjail:unconfined
+	github.com/moby/sys/capability v0.4.0 // gomodjail:unconfined
+	github.com/moby/sys/sequential v0.7.0 // gomodjail:unconfined
+	github.com/moby/sys/signal v0.7.1 // gomodjail:unconfined
+	github.com/moby/sys/symlink v0.3.0 // gomodjail:unconfined
+	github.com/moby/term v0.5.2 // gomodjail:unconfined
 	github.com/morikuni/aec v1.1.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
-	github.com/sirupsen/logrus v1.10.2
-	github.com/spf13/cobra v1.10.2
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // gomodjail:unconfined
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // gomodjail:unconfined
+	github.com/sirupsen/logrus v1.10.2 // gomodjail:unconfined
+	github.com/spf13/cobra v1.10.2 // gomodjail:unconfined
 	github.com/spf13/pflag v1.0.10
-	github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
-	go.opentelemetry.io/otel v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
+	github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346 // gomodjail:unconfined
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // gomodjail:unconfined
+	go.opentelemetry.io/otel v1.46.0 // gomodjail:unconfined
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 // gomodjail:unconfined
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // gomodjail:unconfined
 	go.opentelemetry.io/otel/metric v1.46.0
-	go.opentelemetry.io/otel/sdk v1.46.0
-	go.opentelemetry.io/otel/sdk/metric v1.46.0
+	go.opentelemetry.io/otel/sdk v1.46.0 // gomodjail:unconfined
+	go.opentelemetry.io/otel/sdk/metric v1.46.0 // gomodjail:unconfined
 	go.opentelemetry.io/otel/trace v1.46.0
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/term v0.46.0
+	golang.org/x/sys v0.48.0 // gomodjail:unconfined
+	golang.org/x/term v0.46.0 // gomodjail:unconfined
 	golang.org/x/text v0.42.0
-	gotest.tools/v3 v3.5.2
+	gotest.tools/v3 v3.5.2 // gomodjail:unconfined
 	tags.cncf.io/container-device-interface v1.1.1
 )
 
@@ -77,35 +78,48 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	// gomodjail:unconfined
 	github.com/docker/go-events v0.1.0 // indirect
+	// gomodjail:unconfined
 	github.com/docker/go-metrics v0.1.0 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	// gomodjail:unconfined
 	github.com/gorilla/mux v1.8.1 // indirect
+	// gomodjail:unconfined
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
+	// gomodjail:unconfined
 	github.com/moby/sys/user v0.4.1 // indirect
+	// gomodjail:unconfined
 	github.com/moby/sys/userns v0.2.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	// gomodjail:unconfined
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
+	// gomodjail:unconfined
 	github.com/prometheus/common v0.62.0 // indirect
+	// gomodjail:unconfined
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	go.etcd.io/raft/v3 v3.6.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	// gomodjail:unconfined
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
+	// gomodjail:unconfined
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	golang.org/x/mod v0.41.0 // indirect
+	// gomodjail:unconfined
 	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/time v0.16.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
+	// gomodjail:unconfined
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 )