Suggestion for a configuration option to control the order of shims in the PATH

[y-shinji]

Dear goenv maintainers,

Hello, I am one of the users of goenv, I'm a beginner, so I may be making the wrong suggestions, and I’ve encountered an issue related to the order in which the shims directory is added to the PATH. Currently, the shims directory is added to the end of the PATH, which causes the system-installed Go version to be used instead of the one managed by goenv.

I believe it would be beneficial to introduce a configuration option that allows users to choose the order in which shims is added to the PATH. This way, users can select whether they want goenv to take priority over the system-installed Go or vice versa, based on their specific use case.

I am also aware of the context and discussions around "Security: move shims to end of PATH #247" and understand the concerns raised there. I suggest making this new feature opt-in to address those concerns, ensuring it is explicitly enabled by users who need this flexibility.

Suggestion for using ~/.goenv_config to control shims order in the PATH

Description:

Currently, the goenv tool adds the shims directory to the end of the PATH, which can cause issues if the system-installed Go version should not take precedence. I suggest a more flexible approach using a configuration file (~/.goenv_config) to allow users to control the order in which shims is added to the PATH.

Proposed Solution

I would like to suggest the following improvements to the current approach:

1. Allow users to configure GOENV_PATH_ORDER in ~/.goenv_config:

   • If the GOENV_PATH_ORDER environment variable is set to front, shims should be placed at the front of the PATH.
   • If the variable is set to any other value (or not set at all), the default behavior (adding shims to the back of the PATH) should be maintained.

2. Implementation Update:

• diff style code:

diff --git a/libexec/goenv-init b/libexec/goenv-init
index 3e656c8..e934f7e 100755
--- a/libexec/goenv-init
+++ b/libexec/goenv-init
@@ -87,21 +87,45 @@ mkdir -p "${GOENV_ROOT}/"{shims,versions}

 case "$shell" in
 fish )
-  echo "set -gx GOENV_SHELL $shell"
-  echo "set -gx GOENV_ROOT $GOENV_ROOT"

-  echo 'if not contains $GOENV_ROOT/shims $PATH'
-  echo '  set -gx PATH $PATH $GOENV_ROOT/shims'
-  echo 'end'
+  cat << EOL
+if test -f "\$HOME/.goenv_config"
+  source \$HOME/.goenv_config
+end
+set GOENV_PATH_ORDER (string lower \$GOENV_PATH_ORDER)
+set -gx GOENV_SHELL $shell
+set -gx GOENV_ROOT \$GOENV_ROOT
+if not contains \$GOENV_ROOT/shims \$PATH
+  if [ "\$GOENV_PATH_ORDER" = "front" ]
+    set -x PATH \$GOENV_ROOT/shims \$PATH
+  else
+    set -gx PATH \$PATH \$GOENV_ROOT/shims
+  end
+end
+EOL
+
   ;;
+
 * )
-  echo "export GOENV_SHELL=$shell"
-  echo "export GOENV_ROOT=$GOENV_ROOT"

-  echo 'if [ "${PATH#*$GOENV_ROOT/shims}" = "${PATH}" ]; then'
-  echo '  export PATH="$PATH:$GOENV_ROOT/shims"'
-  echo 'fi'
+  cat << EOL
+if [ -f "\$HOME/.goenv_config" ] ; then
+  source "\$HOME/.goenv_config"
+fi
+GOENV_PATH_ORDER=\$(echo "\$GOENV_PATH_ORDER" | tr '[:upper:]' '[:lower:]')
+export GOENV_SHELL=$shell"
+export GOENV_ROOT=$GOENV_ROOT"
+if [ "\${PATH#*\$GOENV_ROOT/shims}" == "\${PATH}" ]; then
+  if [ "\$GOENV_PATH_ORDER" == "front" ]; then
+    export PATH="\$GOENV_ROOT/shims:\$PATH"
+  else
+    export PATH="\$PATH:\$GOENV_ROOT/shims"
+  fi
+fi
+EOL
+
   ;;
+
 esac

 completion="${root}/completions/goenv.${shell}"

3. Handling the ~/.goenv_config file:

• Users can add the following line in their ~/.goenv_config to control the order:

export GOENV_PATH_ORDER=front   # For bash, etc.
# or
set -x GOENV_PATH_ORDER front   # For fish

• If this variable is not set, the default behavior (shims at the back of PATH) will be followed.
• The filename .goenv_config is just an example; a shorter name, such as .goenvrc, is recommended.

Security Warning:

Please be aware that changing the order of directories in the PATH can have security implications. Specifically, if you set GOENV_PATH_ORDER=front, the Go binary from goenv's shims directory will take precedence over system-wide binaries. This can potentially lead to unintended behavior if there are vulnerabilities in the Go binary or if an attacker has access to modify the shims directory.

Use this configuration at your own risk and ensure that the environment is properly secured. It's advised to only use this configuration if you trust the source of the Go binaries and are aware of the potential risks.

I believe this feature will make goenv more flexible and give users more control over their Go environment without affecting system configuration.

Thank you for taking a look at this suggestion, we hope you'll consider it!

Best regards,

[ChronosMasterOfAllTime]

I like it, if you want make a PR for it and add tests please!

[y-shinji]

Thank you.
I've submitted the PR(Add option to prepend or append shims directory to PATH #417) and tested it with make test-goenv.
I look forward to your feedback.
Best regards,

[ChronosMasterOfAllTime]

Released; it will take about 30 minutes to make it to homebrew