feat: setting to override trusted sites list #1819
Conversation
Seb-MCaw
force-pushed
the
feat/trusted-sites-setting
branch
from
57a0fa6 to
6f5a74c
Compare
|
Ready for review @mosteo. |
There was a problem hiding this comment.
A minor refactor and a general comment:
I find using ' ' or whitespace in general to mean any domain is a bit hackish and won't be nice when printing settings with alr settings. What do you think about using some impossible domain, like '*' or "..." instead? (Probably the latter to avoid interactions with shell expansions at the time of setting.)
src/alire/alire-publish.adb
Outdated
| -- Trusted_Sites -- | ||
| ------------------- | ||
|
|
||
| function Trusted_Sites (Ignore_Setting : Boolean) return Vector is |
There was a problem hiding this comment.
Thinking in positive, I'd prefer if Ignore_Setting were For_Community with the same meaning.
src/alire/alire-index.adb
Outdated
| @@ -129,7 +129,7 @@ package body Alire.Index is | |||
| for Crate of All_Crates.all loop | |||
| for Rel of Crate.Releases loop | |||
| if Rel.Origin.Kind in Origins.VCS_Kinds then | |||
| if not Publish.Is_Trusted (Rel.Origin.URL) then | |||
| if not Publish.Is_Trusted (Rel.Origin.URL, False) then | |||
There was a problem hiding this comment.
Better use the explicit parameter name with => False
src/alire/alire-publish.ads
Outdated
| -- 'origins.git.trusted_sites' setting, otherwise it is the hardcoded | ||
| -- Community_Trusted_Sites list. | ||
|
|
||
| function Is_Trusted (URL : Alire.URL; Ignore_Setting : Boolean) |
There was a problem hiding this comment.
Likewise about Ignore_Setting, either For_Community or For_Private_Index or even some enum:
type Index_Providers is (Community_Index, Private_Index);
Agreed. |
|
Merged, thanks. |
Closes #814.
The
alr publishandalr index --checkcommands currently require that Git origins use a URL with a host found in a hard-coded list of trusted sites, motivated by concerns regarding SHA1 hash collisions. Those using their own hosting arrangements (with private indexes) need to be able to configure this list.This PR makes the list configurable, except when using
alr publishwithout the--for-private-indexswitch.PR creation checklist
doc/user-changes.mdhas been updated, if applicable.