Git Repository root's policy ignored in git worktrees

[scottames]

aqua info

$ aqua info
{
  "version": "2.16.4",
  "commit_hash": "fd3d2911afd67834ecdcf4c282fa294727cee9eb",
  "os": "linux",
  "arch": "amd64",
  "pwd": "/tmp/tmp.rX2ZcQh7Oh/boxes/main",
  "root_dir": "/home/(USER)/.local/share/aquaproj-aqua/bin",
  "env": {
    "AQUA_LOG_COLOR": "always",
    "AQUA_PROGRESS_BAR": "true",
    "AQUA_ROOT_DIR": "/home/(USER)/.local/share/aquaproj-aqua/bin",
    "GITHUB_TOKEN": "(masked)"
  },
  "config_files": [
    {
      "path": "/tmp/tmp.rX2ZcQh7Oh/boxes/main/.aqua/aqua.yaml"
    }
  ]
}

aqua < v2.10.0

$ aqua -v
aqua version 2.16.4 (fd3d2911afd67834ecdcf4c282fa294727cee9eb)

OS (Windows, Linux, macOS, etc): Linux
CPU Architecture (amd64, arm64, etc): amd64

Overview

When using git worktrees the aqua policy for a local registry is ignored.

How to reproduce

1 - Clone Repository and Setup for Worktrees

Note: the repository is just a simple repository that is not at all related to anything here, I chose it because it doesn't really have much in it and does not already have any aqua config.

cd $(mktemp -d)
git clone [email protected]:scottames/boxes.git
cd boxes/
git worktree add -B foo ../foo # adds a worktree in the parent folder

Then create the following aqua config...

2 - Aqua Config in Repository root

.aqua/aqua.yaml

registries:
  - type: standard
    ref: v3.159.0 # renovate: depName=aquaproj/aqua-registry
  - name: local
    type: local
    path: aqua-registry.yaml
packages:
  - name: teleport/[email protected]
    registry: local

.aqua/aqua-registry.yaml

packages:
  - type: http
    repo_owner: teleport
    repo_name: tsh
    url: https://cdn.teleport.dev/teleport-{{.Version}}-{{.OS}}-{{.Arch}}-bin.tar.gz
    files:
      - name: tsh
        dir: teleport
        src: teleport/tsh
    description: Teleport tsh

.aqua/aqua-policy.yaml

registries:
  - type: standard
    ref: semver(">= 3.0.0")
  - name: local
    type: local
    path: aqua-registry.yaml
packages:
  - registry: standard
  - name: teleport/tsh
    registry: local

3 - Attempt to Install local Registry Package

$ aqua i
ERRO[0000] install the package                           aqua_version=2.16.4 doc="https://aquaproj.github.io/docs/reference/codes/002" env=linux/amd64 error="this package isn't allowed" package_name=teleport/tsh package_version=v14.1.1 program=aqua registry=local
FATA[0000] aqua failed

4 - Attempt to Allow Policy

$ aqua policy allow
INFO[0000] no policy file is found                       aqua_version=2.16.4 env=linux/amd64 program=aqua

Note on warning prompt

When run in a non-worktree repository the following warning prompt appears as expected.
When run in the worktree directory (foo above) the warning prompt does not appear.

$ aqua i
WARN[0000] The policy file is ignored unless it is allowed by "aqua policy allow" command.

$ aqua policy allow "/tmp/tmp.qJTSUdDQ1a/boxes/.aqua/aqua-policy.yaml"

If you want to keep ignoring the policy file without the warning, please run "aqua policy deny" command.

$ aqua policy deny "/tmp/tmp.qJTSUdDQ1a/boxes/.aqua/aqua-policy.yaml"

   aqua_version=2.16.4 doc="https://aquaproj.github.io/docs/reference/codes/003" env=linux/amd64 policy_file=/tmp/tmp.qJTSUdDQ1a/boxes/.aqua/aqua-policy.yaml program=aqua
ERRO[0000] install the package                           aqua_version=2.16.4 doc="https://aquaproj.github.io/docs/reference/codes/002" env=linux/amd64 error="this package isn't allowed" package_name=teleport/tsh package_version=v14.1.1 program=aqua registry=local
FATA[0000] aqua failed

Replicate in Primary Repository Root

1. change to non-worktree git root

   cd ../boxes # original clone location (non-worktree)

2. Make sure .aqua files are as outlined above

3. Aqua policy warning appears

4. aqua policy allow runs successfully

5. aqua i runs successfully

6. tsh (package in local registry) runs as expected

Debug output

$ AQUA_LOG_LEVEL=debug aqua i
DEBU[0000] install the proxy                             aqua_version=2.16.4 env=linux/amd64 package_name=aqua-proxy package_version=v1.2.4 program=aqua registry=
DEBU[0000] check if aqua-proxy is already installed      aqua_version=2.16.4 env=linux/amd64 package_name=aqua-proxy package_version=v1.2.4 program=aqua registry=
DEBU[0000] no version_constraint                         aqua_version=2.16.4 env=linux/amd64 package_name=teleport/tsh package_version=v14.1.1 program=aqua registry=local
DEBU[0000] installing the package                        aqua_version=2.16.4 env=linux/amd64 package_name=teleport/tsh package_version=v14.1.1 program=aqua registry=local
ERRO[0000] install the package                           aqua_version=2.16.4 doc="https://aquaproj.github.io/docs/reference/codes/002" env=linux/amd64 error="this package isn't allowed" package_name=teleport/
tsh package_version=v14.1.1 program=aqua registry=local
FATA[0000] aqua failed                                   aqua_version=2.16.4 env=linux/amd64 error="it failed to install some packages" program=aqua

Expected behaviour

Running aqua with a local registry and policy in the git repository's root runs without issue whether in a git worktree or not, the policy should not be ignored.

Actual behaviour

Running aqua with local registry and policy in the git repository's root in a git worktree causes the policy to be ignored, but the other files (aqua.yaml + registry) to be picked up and thus the local registry to be denied because the policy is not picked up.

Important Factoids

Note: I did test a bit more with adding the policy and config to AQUA_POLICY_CONFIG and AQUA_GLOBAL_CONFIG respectively. The registry & policy worked as expected in all directories except the git worktree directories.

Reference

• https://aquaproj.github.io/docs/reference/security/policy-as-code/git-policy/

[suzuki-shunsuke]

Thank you for your report!
I didn't know git worktree.
aqua expects .git is a directory but in git worktree .git is a file, so aqua policy doesn't work well in git worktree.
I'll fix this soon.

[scottames]

Awesome, thanks! Myself and my team will be super appreciative!

[suzuki-shunsuke]

• fix(policy): fix a bug that the Git Repository root's policy file doesn't work well in working trees #2479

[suzuki-shunsuke]

aqua v2.17.3 is out 🎉
https://github.com/aquaproj/aqua/releases/tag/v2.17.3

The issue was resolved by #2479 .

[scottames]

That did the trick! Thanks so much for the quick fix. Keep up the great work!