Filter gitignored files when building the publish archive#10066
Open
plemarquand wants to merge 1 commit into
Open
Filter gitignored files when building the publish archive#10066plemarquand wants to merge 1 commit into
plemarquand wants to merge 1 commit into
Conversation
Rewrites `PackageArchiver.archive` so publishing no longer leaks sensitive files that happen to live in the package directory. For git-tracked packages the archive is now built from `git archive HEAD`, so only tracked content ships. Files referenced by `.gitignore` and `.gitattributes export-ignore` are excluded from the archive. For non-git packages a recursive copy with a denylist (.env*, .netrc, id_rsa/id_ed25519/id_ecdsa keypairs, credentials*.json, secrets.json, *.pem, *.key, *.p12, *.pfx, etc.) replaces the previous four-entry top-level filter, and a warning log entry points the towards using git based .gitignore or .gitattributes for deterministic filtering. This patch updates both the `swift package-registry publish` and `swift package archive-source` commands.
plemarquand
requested review from
bkhouri,
bripeticca,
cmcgee1024,
daveinglis,
daveyc123,
dschaefer2,
jakepetroules,
owenv and
rconnell9
as code owners
Contributor
Author
|
@swift-ci test |
Contributor
Author
|
@swift-ci test windows platform |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation:
When building a package archive to publish the archiver strips omits
.build,.git,.gitignoreand.swiftpmusing a hardcoded list. Any files the user has explicitly .gitignored are still included in the package archive.Modifications:
Rewrites PackageArchiver.archive so publishing no longer leaks sensitive files that happen to live in the package directory. For git-tracked packages the tarball is now built from
git archive HEAD, so only tracked content ships and .gitattributes export-ignore is honored.For non-git packages a recursive copy with a denylist (.env*, .netrc, id_rsa/id_ed25519/id_ecdsa keypairs, credentials*.json, secrets.json, *.pem, *.key, *.p12, *.pfx, etc.) replaces the previous four-entry top-level filter, and a warning log entry points the user at git or .gitattributes for deterministic filtering.
Result:
Archives created using
swift package-registry publishandswift package archive-sourcenow respect the user's ignored files.