|
| 1 | +== GitBark Core |
| 2 | +A collection of useful rules and subcommands for use in link:https://github.com/YubicoLabs/gitbark[GitBark]. |
| 3 | + |
| 4 | +=== Usage |
| 5 | +To use this package in GitBark include the package reference in the `requirements.txt` file, that should be located in the `bark_rules` branch (for more information see link:https://github.com/YubicoLabs/gitbark/blob/main/doc/Overview.adoc#bark-modules[here]). Below is an example: |
| 6 | + |
| 7 | +---- |
| 8 | +# requirements.txt |
| 9 | +git+https://github.com/YubicoLabs/gitbark-core.git |
| 10 | +---- |
| 11 | + |
| 12 | +The module can also be added interactively using the `bark add-modules` command. |
| 13 | + |
| 14 | + |
| 15 | +=== Commit Rules |
| 16 | + |
| 17 | +==== `require_signature` |
| 18 | + |
| 19 | +This rule mandates that a commit must be signed by a specific key, supporting both SSH and OpenPGP keys, including Security Keys. |
| 20 | + |
| 21 | +The authorized keys are defined as one or a list of glob patterns matching the specific public key files, which should be checked into the repository and reside in `/.bark/.pubkeys/`. |
| 22 | + |
| 23 | +Here is an example configuration of this rule in the `commit_rules.yaml` file: |
| 24 | + |
| 25 | +[source, yaml] |
| 26 | +---- |
| 27 | +rules: |
| 28 | +- require_signature: |
| 29 | + authorized_keys: [Alice.pub, Bob.pub] |
| 30 | +---- |
| 31 | +In this configuration, only commits signed with Alice's or Bob's key are considered authorized. |
| 32 | + |
| 33 | +==== `file_not_modified` |
| 34 | + |
| 35 | +This rule prevents modification to specific fles. |
| 36 | + |
| 37 | +The set of files that should remain unmodified is defined as one or more glob patterns. |
| 38 | + |
| 39 | +An example configuration of this rule in the `commit_rules.yaml` file is shown below: |
| 40 | + |
| 41 | +[source, yaml] |
| 42 | +---- |
| 43 | +rules: |
| 44 | +- file_not_modified: |
| 45 | + pattern: sensitive.json |
| 46 | +---- |
| 47 | + |
| 48 | +To achieve file-level authorization one can combine this rule with `require_signature` using the `any` clause (for more information on the `any` clause see link:https://github.com/YubicoLabs/gitbark/blob/main/doc/Overview.adoc#specification[here]). |
| 49 | + |
| 50 | +Here is an example of that configuration: |
| 51 | + |
| 52 | +[source, yaml] |
| 53 | +---- |
| 54 | +rules: |
| 55 | +- any: |
| 56 | + - file_not_modified: |
| 57 | + pattern: sensitive.json |
| 58 | + - require_signature: |
| 59 | + authorized_keys: Alice.pub |
| 60 | +---- |
| 61 | +In this configuration the two rules are evaluated using OR logic, meaning that at least one of them need to be satisfied. The resulting behavior stipulates that `sensitive.json` cannot be modified unless the commit is signed by Alice. |
| 62 | + |
| 63 | +==== `max_parents` |
| 64 | +This rule requires a commit to have a maximum number of parents. |
| 65 | + |
| 66 | +An example configuration of this rule in the `commit_rules.yaml` file is shown below: |
| 67 | + |
| 68 | +[source, yaml] |
| 69 | +---- |
| 70 | +rules: |
| 71 | +- max_parents: |
| 72 | + threshold: 1 |
| 73 | +---- |
| 74 | +In this configuration, the rule mandates that a commit can have a maximum of one parent. |
| 75 | + |
| 76 | + |
| 77 | +==== `require_valid_parents` |
| 78 | +By default, not all commits are required to be valid in GitBark. The framework only ensures that a commit is validated against the rules defined in the nearest **valid** ancestor commit. |
| 79 | + |
| 80 | +Using this rule you can reuire ALL parents of a commit to be valid, as seen below: |
| 81 | + |
| 82 | +[source, yaml] |
| 83 | +---- |
| 84 | +rules: |
| 85 | +- require_valid_parents: |
| 86 | +---- |
| 87 | + |
| 88 | +Optionally, you can allow non-valid parents as long as their commit hashes are included in the commit message (this makes allowing them more explicit, which prevent accidental inclusion). To accomplish this, use the `allow_explicit` parameter, as illustrated below: |
| 89 | + |
| 90 | +[source, yaml] |
| 91 | +---- |
| 92 | +rules: |
| 93 | +- require_valid_parents: |
| 94 | + allow_explicit: True |
| 95 | +---- |
| 96 | + |
| 97 | +=== Ref Rules |
| 98 | + |
| 99 | +==== `require_approval` |
| 100 | +This rule requires commits on specific references to be **Approved** by a predetermined number of people. |
| 101 | + |
| 102 | +An **Approved** commit is a merge commit comprising a previous commit from the target ref, followed by one or more **Approval** commits. All its approval commits must have the same tree hash as the approved commit, and must include the approved commits initial parent in their set of parents. All approval commits must also have the same set of parents, and must be valid according to their commit rules. |
| 103 | + |
| 104 | +Essentially, an approval commit is a "normal" merge commit, with additional approvals being copies of the first approval, but with different authors (and possible messages). The *approved* commit is then an octo-merge commit containing the merge target, and all approval commits. |
| 105 | + |
| 106 | +To configure this rule, you must define the set of authorized approvers (as a list of email addresses) and the approval threshold. |
| 107 | + |
| 108 | +An example configuration of this rule in the `bark_rules.yaml` file is shown below: |
| 109 | + |
| 110 | +[source, yaml] |
| 111 | +---- |
| 112 | +project: |
| 113 | +- bootstrap: 80a177b2b7fc39b4dd664fcda0cd185457fbaaeb |
| 114 | + refs: |
| 115 | + - pattern: refs/heads/main |
| 116 | + rules: |
| 117 | + - require_approval: |
| 118 | + threshold: 2 |
| 119 | + authorized_authors: |
| 120 | + - alice@test.com |
| 121 | + - bob@test.com |
| 122 | +---- |
| 123 | +This configuration requires the HEAD commit on `refs/heads/main` to be **Approved** by Alice and Bob. |
| 124 | + |
| 125 | +==== `require_fast_forward` |
| 126 | +This rule requires changes on specific references to be fast-forward only (i.e. no force pushing, linear history). |
| 127 | + |
| 128 | +An example configuration of this rule is shown below: |
| 129 | + |
| 130 | +[source, yaml] |
| 131 | +---- |
| 132 | +project: |
| 133 | +- bootstrap: 80a177b2b7fc39b4dd664fcda0cd185457fbaaeb |
| 134 | + refs: |
| 135 | + - pattern: refs/heads/main |
| 136 | + rules: |
| 137 | + - require_fast_forward: |
| 138 | +---- |
| 139 | +This configuration prevents non-fast-forward changes on `refs/heads/main`. |
| 140 | + |
| 141 | + |
| 142 | + |
| 143 | + |
0 commit comments