docs: config system spec (layered .xffrc + root-owned system policy) - #73
Merged
Conversation
design-config.md specs the five-layer model (built-in < system /etc/xff.ini < user ~/.config/xff < project ./.xffrc < CLI). The root-owned system file holds the per-flag capability policy (safe/sensitive/destructive classes); no lower layer can widen its own permissions. Safe-by-default: with no admin policy a project .xffrc may set safe flags only, never exec/capture/delete, so a hostile repo cannot run code (dropped-and-warned, not fatal). Covers the .xffrc bazel-rc grammar, --config/--feature/--xffrc/--no-config selectors, argv[0] dispatch, and a phased roadmap B-E. Extends design.md Security section and renames the explicit-file flag to --xffrc=FILE.
helly25
added a commit
that referenced
this pull request
Jun 28, 2026
…oadmap decisions (#193) Per the directive to put enforcement rules in the repo, not just memory: AGENTS.md gains two sections: - Self-documenting features: the registry + globals are the doc SOT; every feature add/change updates its Descriptor.summary / GlobalFlag entry + kHelpText in the same change, so --help/--man/--markdown stay complete. - CLI conventions: flag scope by dash count (--global vs -primary; -h/-q/-help/ -version are special-cased compat globals); flag-only, no subcommands; and a user-toggleable boolean capability is a --feature, not a one-off flag. TODO.md roadmap decisions (design phase, accounting for existing code): - #43 parallel traversal + --sort: already BUILT (ReadPool, sort modes, tests, tsan cell); remaining is a CLI bashtest. - #45 --exact/--path-encoding: default = filesystem-native (natural per-platform case behavior); --exact forces verbatim byte matching; --path-encoding=raw|escape. - #73 --feature: PARKED (no customer yet) with the full ready-to-build design + a trigger (first boolean capability builds it); trigger mirrored in AGENTS.md. - #54 mode mechanism: subsumed by --config (no --mode flag; --modern deferred).
helly25
added a commit
that referenced
this pull request
Jul 6, 2026
Record the architecture decision that heavy/special libs (libarchive #83, pcre2 #85, future ones) are build-time composable extras behind Bazel flags: default lean core (RE2, no archive), an extended binary composed from the same tree via bool_flag + config_setting + select() + -DXFF_WITH_* defines, a .bazelrc --config=full convenience, runtime feature-reporting + graceful "not built in" errors, and a NOTICE assembled from the enabled set. Distinct from the #73 --feature runtime gates. Also record the #85 pcre2 finding + plan: pcre2 is in the BCR (upstream-maintained, 10.47), a clean BSD-3-Clause dep (no new license type); add a PCRE2-backed regex::Matcher gated by the //xff:pcre extra, RE2 stays the default, PCRE2 opt-in via -regextype with match/backtrack limits (ReDoS).
helly25
added a commit
that referenced
this pull request
Jul 6, 2026
…time extras (#276) * docs(TODO): record #83 archive decision - libarchive + NOTICE plan Archive diving (--archive) will use libarchive via its BCR module, as a read-only vfs::FileSystem backend (entries as virtual paths, so the predicate/action set incl. -grep works unchanged). Two build variants planned: minimal (tar+gz+bz2) and extended (+xz/zstd/zip). NOTICE obligations are all permissive: net-new types BSD-2-Clause / Zlib / bzip2-1.0.6 / 0BSD; the dual-licensed zstd and mbedtls are pinned to their permissive arms (BSD-3 / Apache-2.0), lz4's library (BSD-2) not its GPL CLI, so no copyleft. Third-party notices maintained + scaled to the enabled codec set. * docs(TODO): composable build-time extras + pcre2 (#85) plan Record the architecture decision that heavy/special libs (libarchive #83, pcre2 #85, future ones) are build-time composable extras behind Bazel flags: default lean core (RE2, no archive), an extended binary composed from the same tree via bool_flag + config_setting + select() + -DXFF_WITH_* defines, a .bazelrc --config=full convenience, runtime feature-reporting + graceful "not built in" errors, and a NOTICE assembled from the enabled set. Distinct from the #73 --feature runtime gates. Also record the #85 pcre2 finding + plan: pcre2 is in the BCR (upstream-maintained, 10.47), a clean BSD-3-Clause dep (no new license type); add a PCRE2-backed regex::Matcher gated by the //xff:pcre extra, RE2 stays the default, PCRE2 opt-in via -regextype with match/backtrack limits (ReDoS).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase A of the config system (#58): the reviewable spec at docs/design-config.md.
Model: five layers, lowest to highest precedence (CLI wins) - built-in, system /etc/xff.ini, user ~/.config/xff, project ./.xffrc, CLI. The root-owned system file is the trust anchor: it alone holds the per-flag capability policy, so no lower layer can widen its own permissions.
Safe-by-default (the key property): with no /etc/xff.ini present, the built-in policy lets a project .xffrc set safe flags (output/traversal) but never sensitive (-exec/--capture) or destructive (-delete). A hostile repo .xffrc can recolor output, not run code, and is dropped-and-warned rather than fatal so it cannot DoS the run.
Also specs the .xffrc bazel-rc base:config: grammar, --config=NAME (stacks; find/xff built-in, subsumes --style), --feature, --xffrc=FILE, --no-config, argv[0] dispatch, and a phased roadmap (B loader, C policy gate + rejection tests, D styles/tagging/filter, E argv0/cascade/explain).
Extends design.md Security section (adds the system-policy layer; renames the explicit-file flag to --xffrc=FILE).
Open decision flagged in the doc: enforcement on overstep - drop-and-warn (specced) vs hard-error.