How am I supposed to pass multiple policy files to update checksums against?

[sheldonhull]

Question

I have a repo containing both the project level .aqua configuration, and also my global configuration that I deploy via chezmoi.

Background of the question

• Am i supposed to be able to pass both policies, or would I need to invoke 2x for each?
• Also, is it important for me to pass the paths for the files for all commands related to policy and checksum, or will the checksum command find all the .aqua files without me needing to specify that it's in the .aqua directory (all my projects have moved to this as it's much cleaner).

Example Code

---
name: update-aqua-checksum
on:
  pull_request:
    paths:
      - aqua.yaml
      - aqua-checksums.json
      - .aqua/aqua.yaml
      - .aqua/aqua-checksums.json
      - private_dot_config/exact_aqua/aqua.yaml
      - private_dot_config/exact_aqua/aqua-checksums.json
jobs:
  update-aqua-checksums:
    uses: aquaproj/update-checksum-workflow/.github/workflows/update-checksum.yaml@7a77a05ec15945a7360f871e7751547acfae4f41 # renovate: tag=v0.1.6
    permissions:
      contents: write
    with:
      aqua_policy_config: '.aqua/aqua-policy.yaml:private_dot_config/exact_aqua/aqua-policy.yaml'
      aqua_version: v2.6.0
      prune: true
      policy_allow: '.aqua/aqua-policy.yaml:private_dot_config/exact_aqua/aqua-policy.yaml'
    secrets:
      gh_token: '${{secrets.GITHUB_TOKEN}}'

Reference

No response

[suzuki-shunsuke]

The input policy_allow doesn't support multiple files at the moment.
And you don't have to specify the same file in both aqua_policy_config and policy_allow.

Please try the following code.

      aqua_policy_config: 'private_dot_config/exact_aqua/aqua-policy.yaml'
      policy_allow: 'true'

  update-aqua-checksums:
    uses: aquaproj/update-checksum-workflow/.github/workflows/update-checksum.yaml@7a77a05ec15945a7360f871e7751547acfae4f41 # renovate: tag=v0.1.6
    permissions:
      contents: write
    with:
      aqua_policy_config: 'private_dot_config/exact_aqua/aqua-policy.yaml'
      aqua_version: v2.6.0
      prune: true
      policy_allow: 'true'
    secrets:
      gh_token: '${{secrets.GITHUB_TOKEN}}'

[suzuki-shunsuke]

policy_allow: 'true' searches Git Repository root's policy file.

• aqua-policy.yaml
• .aqua-policy.yaml
• aqua/aqua-policy.yaml
• .aqua/aqua-policy.yaml

https://aquaproj.github.io/docs/reference/security/policy-as-code/git-policy

[suzuki-shunsuke]

Also, is it important for me to pass the paths for the files for all commands related to policy and checksum, or will the checksum command find all the .aqua files without me needing to specify that it's in the .aqua directory (all my projects have moved to this as it's much cleaner).

If the input policy_allow is set, aqua policy allow command is run.
You have to run aqua policy allow command only once per policy file.

[suzuki-shunsuke]

You have to run aqua policy allow command only once per policy file.

On the other hand, if you specify policy files by AQUA_POLICY_CONFIG, you have to set AQUA_POLICY_CONFIG for all commands related to policy.

[suzuki-shunsuke]

I have a repo containing both the project level .aqua configuration, and also my global configuration that I deploy via chezmoi.

The simple solution is to merge global policy into project level policy.
I didn't assume to use global policy in CI from aqua v2.3.0.

[suzuki-shunsuke]

https://aquaproj.github.io/docs/reference/security/policy-as-code/git-policy/#why-this-feature-is-needed

We introduced Git Repository root's policy file to resolve the issue of AQUA_POLICY_CONFIG.

To use non Standard Registries, you had to set the environment variable AQUA_POLICY_CONFIG. But it is bothersome, especially in the team development because all members have to set the environment variable AQUA_POLICY_CONFIG. Some tools such as direnv are useful to set environment variables, but it is undesirable to ask users to install additional tools for aqua.

So I propose to merge global policy into project level policy.

[sheldonhull]

I use repo policy, works fine.
However my personal dev tools are covered in a global aqua config. I assumed I'd need a policy file in the global directory so running with --all would work.

This is the one I'm having confusion on.

[suzuki-shunsuke]

If you manage your global configuration with Git, you can manage a policy for the global configuration in the same Git repository.
Then you don't have to specify AQUA_POLICY_CONFIG.

[sheldonhull]

Sorry, let me break down the actions and you can educate me.

1. I use chezmoi.
2. I run chezmoi apply
3. $HOME/.config/aqua/aqua.yaml, $HOME/.config/aqua/aqua-policy.yaml, $HOME/.config/aqua/registry.yaml are created.
4. As part of reapply dotfiles it automatically runs aqua install --all --only-link so all my tools are updated.
5. Now I want to run aqua install --all from anywhere, including if I've got an existing project with aqua in it.

• I want to just run aqua policy allow and it work for my repo.
• I want to also be able to run aqua install --all for my global one anytime to add missing tools.
• If I set AQUA_POLICY_CONFIG I can't leverage the repo policy automation and now have to custom set a PROJECTPATH:GLOBALPATH variable which is clunky and easy to forget.

So would this mean I need to modify the template below as noted with the 👈 emoji?

#!/usr/bin/env bash
export PATH="${AQUA_ROOT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/aquaproj-aqua}/bin:$PATH"
{{ if eq .chezmoi.os "darwin" -}}
package=aquaproj/aqua/aqua
brew list $package &>/dev/null || brew install $package
{{ else }}
if command -v aqua &>/dev/null; then
  echo "ℹ️ aqua already installed: $(aqua --version)"
  printf "⚙️ updating aqua... "
  aqua update-aqua
  aqua update-checksum -prune
  printf "✔️️ aqua update-aqua\n"
else
  echo "ℹ️ aqua command not detected"
  curl -sSfL https://raw.githubusercontent.com/aquaproj/aqua-installer/v1.1.2/aqua-installer | sudo bash -s -- -i '/usr/local/bin/aqua'
fi
echo "✔️️ install aqua $(aqua --version) successfully"
{{ end }}
printf "⚙️ running aqua install... "
# aqua policy allow "${XDG_CONFIG_HOME:-$HOME/.config/}/aqua/aqua-policy.yaml" # DO I NEED THIS? 👈👈👈👈👈👈
aqua install --all --only-link
printf "✔️️\n"

[suzuki-shunsuke]

What's your AQUA_GLOBAL_CONFIG?
If AQUA_GLOBAL_CONFIG includes files in the repository ${XDG_CONFIG_HOME:-$HOME/.config/},
You need to run aqua policy allow "${XDG_CONFIG_HOME:-$HOME/.config/}/aqua/aqua-policy.yaml".

e.g.

# export AQUA_GLOBAL_CONFIG=$HOME/.config/aqua/aqua.yaml
# Directory structure
~/.config/
  .git
  aqua/
    aqua-policy.yaml # Git Repository root's policy file for the Git repository `~/.config`
    aqua.yaml # $AQUA_GLOBAL_CONFIG

But you only have to run the command only at once unless the policy file isn't changed,
so you don't necessarily have to run the command in file such as .bashrc.

And it may be a bit danger to run aqua policy allow automatically because the policy file may be tampered (Of course, in CI we have to run the command automatically).
Ideally, you should check the content of policy file before allowing it.
Of course I understand the tampering rarely occurs.