Policy: add scopes to ease usability #34552
Conversation
bmeck
added
wip
|
I've noted that full protocol scoping is not currently possible for |
|
Ugggg, |
bmeck
force-pushed
the
policy-scopes
branch
3 times, most recently
from
e25f721
to
6233f31
Compare
|
rebased due to this and conditions landing a bit uncleanly |
|
this is pretty much just ready for review, some odd quirks about node do leak out like how the '-e' and '-p' CLI flags treat their location as files? |
doc/api/policy.md
Outdated
| If a dependency is not found, the resource may include `"cascade": true` which | ||
| will delegate to a scope. Scopes may also use `"cascade": true`. The scope for |
There was a problem hiding this comment.
These two sentences are a bit confusing and awkward together
There was a problem hiding this comment.
how about combining them:
If a scope or resource includes
"cascade": trueunknown specifiers will
be searched for in their containing scope.
test/fixtures/policy/dependencies/dependencies-scopes-policy.json
Outdated
Show resolved
Hide resolved
|
Wrote up some attack concerns on adding this feature in some slides. I believe the risk of using this feature is acceptable. |
bmeck
added
the
author ready
|
I intend to land this on Monday. |
|
rebased but waiting on ci reliability (seems unrelated?) |
PR-URL: #34552 Reviewed-By: James M Snell <jasnell@gmail.com>
|
Landed in 4234904 |
PR-URL: #34552 Reviewed-By: James M Snell <jasnell@gmail.com>
Checklist
make -j4 test(UNIX), orvcbuild test(Windows) passesThis adds a mechanism matching
package.jsonthat allows setting default "integrity" and "dependency" values by a URL subspace. It also adds the ability to opt-in to cascading permissions by introducing"cascade": true. It uses a separate field in the policy file due to collisions of string representation of scopes and potential resources.