Remove all dependencies on github.com/loft-sh modules and harden the SSH server

.github/workflows/go-licenses-check.yaml

@@ -33,6 +33,6 @@ jobs:
       - name: Run go-licenses check
         # go.mod's toolchain directive makes `go` switch to a downloaded toolchain, so point
         # GOROOT at it; otherwise go-licenses doesn't recognize standard library packages
-        run: GOROOT="$(go env GOROOT)" go-licenses check ./... --ignore github.com/loft-sh
+        run: GOROOT="$(go env GOROOT)" go-licenses check ./... --ignore github.com/loft-sh/devpod
         env:
           GOPRIVATE: "github.com/loft-sh/*"

.github/workflows/go-licenses.yaml

@@ -37,7 +37,7 @@ jobs:
       - name: Run go-licenses
         # go.mod's toolchain directive makes `go` switch to a downloaded toolchain, so point
         # GOROOT at it; otherwise go-licenses doesn't recognize standard library packages
-        run: GOROOT="$(go env GOROOT)" go-licenses report ./... > docs/pages/licenses/devpod.mdx --template .github/licenses.tmpl --ignore github.com/loft-sh
+        run: GOROOT="$(go env GOROOT)" go-licenses report ./... > docs/pages/licenses/devpod.mdx --template .github/licenses.tmpl --ignore github.com/loft-sh/devpod
 
       - name: Point license links at this repository
         # go-licenses builds the links from the Go module path, which is still github.com/loft-sh/devpod

AGENTS.md

@@ -80,6 +80,11 @@ cd src-tauri && cargo +stable check
   the binary, which also runs as the agent. Use `pkg/kubeclient`, which only registers core/v1 and rbac/v1; add a
   resource or group there if you need one. `go list -deps . | grep '^k8s.io/client-go/kubernetes'` must print
   nothing.
+- **Don't depend on `github.com/loft-sh` modules** (other than this module's own path). They are no longer
+  maintained, and the ones DevPod used now live here: the logger is `pkg/log` (`log.Logger`, `log.Default`,
+  `pkg/log/table`, `pkg/log/survey`), and the SSH server that runs in the container is `pkg/ssh/sshd`, a copy of
+  `gliderlabs/ssh` with unix socket forwarding added. Check that a new dependency is maintained before adding
+  it.
 - **gRPC tunnel code is generated.** After editing `pkg/agent/tunnel/tunnel.proto`, regenerate with
   `hack/build-grpc.sh` (needs `protoc`; existing code uses protoc-gen-go v1.36.4 and protoc-gen-go-grpc v1.5.1).
 - **CI quirks:**

CHANGELOG.md

@@ -17,6 +17,24 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Fixed
 
+- Security hardening of the SSH server that DevPod runs in the dev container ([#22](https://github.com/curityio/devpod/pull/22)), for issues
+  inherited from upstream:
+  - A reverse forward of a unix socket (as GPG agent forwarding uses) no longer deletes whatever is at the
+    socket path. DevPod only replaces a socket that nothing listens on and that belongs to the server's user (or
+    to anyone, when the server runs as root), and refuses the forward otherwise. Before, a second session
+    forwarding the same socket took it over, and ending either session removed it for both.
+  - The directory of a browser IDE's shared ssh-agent socket (`/tmp/auth-agent-<id>`) must be a real directory
+    owned by the server's user with mode 0700, and the socket has mode 0600. Before, the server used whatever
+    was at that path, so another user in the container could create it first. Ending a session removes the
+    directory only if it is empty, so it doesn't take the socket from the next session.
+  - One SSH connection can no longer cancel another connection's TCP or unix socket reverse forward: forwards
+    are tracked per connection instead of by address only.
+- Automatic language detection ([#22](https://github.com/curityio/devpod/pull/22)), used when `devcontainer.json` has no image, Dockerfile or Compose file, now
+  recognizes C++, C# and PHP projects, and no longer ignores files whose names merely contain `env`, `dist` or
+  `cache`.
+- When a required provider option without a list of allowed values has no value, DevPod prompts for it in the
+  terminal again ([#22](https://github.com/curityio/devpod/pull/22)). Before, the prompt failed with "please provide options to select from".
+- `devpod` log files (such as the agent daemon's) are rotated at 10 MB as intended, instead of 10 TB ([#22](https://github.com/curityio/devpod/pull/22)).
 - `devpod upgrade` and the CLI's newer-version check use this fork's releases on `curityio/devpod`. Before,
   they used upstream `loft-sh/devpod`, so `devpod upgrade` replaced the CLI with an upstream binary.
 - `postStartCommand` now runs again when DevPod starts a stopped dev container, e.g. on `devpod ssh` or
@@ -35,6 +53,13 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Changed
 
+- DevPod no longer depends on any `github.com/loft-sh` Go module ([#22](https://github.com/curityio/devpod/pull/22)), as these are no longer maintained. The logger
+  (`loft-sh/log`) is now part of `pkg/log`, the SSH server (`loft-sh/ssh`, a fork of `gliderlabs/ssh`) is
+  `pkg/ssh/sshd`, and language detection (`loft-sh/programming-language-detection`) is in `pkg/language`. The
+  unmaintained libraries they used are gone too: terminal prompts use `charmbracelet/huh` instead of the archived
+  `AlecAivazis/survey`, tables are rendered by DevPod instead of an old `olekukonko/tablewriter`, and
+  `mgutz/ansi`, `acarl005/stripansi`, `k0kubun/go-ansi` and `anmitsu/go-shlex` are replaced by a few lines of
+  code.
 - The DevPod CLI embeds the Linux agent for amd64 and arm64 ([#19](https://github.com/curityio/devpod/pull/19)),
   whatever platform it runs on, and copies it into machines and dev containers itself. It no longer downloads the
   agent from GitHub releases, so the agent always has the same version as the CLI, and workspaces can be created
@@ -54,6 +79,8 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Removed
 
+- The hidden `devpod agent container ssh-server` command ([#22](https://github.com/curityio/devpod/pull/22)). Only DevPod Pro started it, and it accepted any
+  SSH client without authentication and ran its shell as whichever user the client named.
 - The built-in Amazon ECR registry keychain ([#21](https://github.com/curityio/devpod/pull/21)), which DevPod used when it ran inside a Kubernetes pod, together
   with the AWS SDK it needed. To use ECR, configure
   [`docker-credential-ecr-login`](https://github.com/awslabs/amazon-ecr-credential-helper) as a credential

cmd/agent/agent.go

@@ -9,7 +9,7 @@ import (
 	"github.com/loft-sh/devpod/pkg/client/clientimplementation"
 	"github.com/loft-sh/devpod/pkg/config"
 	"github.com/loft-sh/devpod/pkg/envfile"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

cmd/agent/container/container.go

@@ -17,6 +17,5 @@ func NewContainerCmd(flags *flags.GlobalFlags) *cobra.Command {
 	containerCmd.AddCommand(NewVSCodeAsyncCmd())
 	containerCmd.AddCommand(NewOpenVSCodeAsyncCmd())
 	containerCmd.AddCommand(NewCredentialsServerCmd(flags))
-	containerCmd.AddCommand(NewSSHServerCmd(flags))
 	return containerCmd
 }

cmd/agent/container/credentials_server.go

@@ -16,9 +16,9 @@ import (
 	"github.com/loft-sh/devpod/pkg/dockercredentials"
 	"github.com/loft-sh/devpod/pkg/gitcredentials"
 	"github.com/loft-sh/devpod/pkg/gitsshsigning"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/loft-sh/devpod/pkg/netstat"
 	portpkg "github.com/loft-sh/devpod/pkg/port"
-	"github.com/loft-sh/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/daemon.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/loft-sh/devpod/pkg/agent"
 	agentd "github.com/loft-sh/devpod/pkg/daemon/agent"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/container/openvscode_async.go

@@ -7,7 +7,7 @@ import (
 	"github.com/loft-sh/devpod/pkg/compress"
 	"github.com/loft-sh/devpod/pkg/devcontainer/config"
 	"github.com/loft-sh/devpod/pkg/ide/openvscode"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/setup.go

@@ -35,9 +35,9 @@ import (
 	"github.com/loft-sh/devpod/pkg/ide/openvscode"
 	"github.com/loft-sh/devpod/pkg/ide/rstudio"
 	"github.com/loft-sh/devpod/pkg/ide/vscode"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
 	"github.com/loft-sh/devpod/pkg/single"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/container/vscode_async.go

@@ -7,7 +7,7 @@ import (
 	"github.com/loft-sh/devpod/pkg/compress"
 	"github.com/loft-sh/devpod/pkg/devcontainer/config"
 	"github.com/loft-sh/devpod/pkg/ide/vscode"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )

cmd/agent/container_tunnel.go

@@ -15,8 +15,8 @@ import (
 	"github.com/loft-sh/devpod/pkg/devcontainer/config"
 	"github.com/loft-sh/devpod/pkg/devcontainer/setup"
 	"github.com/loft-sh/devpod/pkg/encoding"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/daemon.go

@@ -12,8 +12,8 @@ import (
 	"github.com/loft-sh/devpod/pkg/agent"
 	"github.com/loft-sh/devpod/pkg/client/clientimplementation"
 	"github.com/loft-sh/devpod/pkg/driver/custom"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/log"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

cmd/agent/docker_credentials.go

@@ -14,7 +14,7 @@ import (
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/dockercredentials"
 	devpodhttp "github.com/loft-sh/devpod/pkg/http"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/git_credentials.go

@@ -13,7 +13,7 @@ import (
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/gitcredentials"
 	devpodhttp "github.com/loft-sh/devpod/pkg/http"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/git_ssh_signature.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/gitsshsigning"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/git_ssh_signature_helper.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/gitsshsigning"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/workspace/build.go

@@ -6,8 +6,8 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )

cmd/agent/workspace/delete.go

@@ -8,8 +8,8 @@ import (
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
 	agentdaemon "github.com/loft-sh/devpod/pkg/daemon/agent"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )

cmd/agent/workspace/install_dotfiles.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/git"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/workspace/logs.go

@@ -8,7 +8,7 @@ import (
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
 	"github.com/loft-sh/devpod/pkg/devcontainer"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/workspace/logs_daemon.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )

cmd/agent/workspace/setup_gpg.go

@@ -9,7 +9,7 @@ import (
 	"github.com/loft-sh/devpod/pkg/credentials"
 	"github.com/loft-sh/devpod/pkg/gitcredentials"
 	"github.com/loft-sh/devpod/pkg/gpg"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/workspace/status.go

@@ -8,7 +8,7 @@ import (
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
 	"github.com/loft-sh/devpod/pkg/client"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/workspace/stop.go

@@ -6,8 +6,8 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )

cmd/agent/workspace/up.go

@@ -22,10 +22,10 @@ import (
 	config2 "github.com/loft-sh/devpod/pkg/devcontainer/config"
 	"github.com/loft-sh/devpod/pkg/dockercredentials"
 	"github.com/loft-sh/devpod/pkg/extract"
+	"github.com/loft-sh/devpod/pkg/log"
 	provider2 "github.com/loft-sh/devpod/pkg/provider"
 	"github.com/loft-sh/devpod/pkg/util"
 	"github.com/loft-sh/devpod/scripts"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/workspace/update_config.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/agent"
-	"github.com/loft-sh/log"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/build.go

@@ -13,9 +13,9 @@ import (
 	"github.com/loft-sh/devpod/pkg/config"
 	config2 "github.com/loft-sh/devpod/pkg/devcontainer/config"
 	"github.com/loft-sh/devpod/pkg/image"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/loft-sh/devpod/pkg/provider"
 	workspace2 "github.com/loft-sh/devpod/pkg/workspace"
-	"github.com/loft-sh/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/completion/suggestions.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/loft-sh/devpod/cmd/flags"
 	"github.com/loft-sh/devpod/pkg/config"
+	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/loft-sh/devpod/pkg/workspace"
-	"github.com/loft-sh/log"
 )
 
 func RegisterFlagCompletionFuns(rootCmd *cobra.Command, globalFlags *flags.GlobalFlags) error {