Module source 

External rule sources: git repositories cloned into a local cache, plus extra local directories. Each configured [[rules.sources]] is resolved to a directory of rule YAML and the provenance stamped on the rules loaded from it.

External sources are untrusted input, so every git call is hardened:

• A URL or ref starting with - is rejected before git runs (git would parse it as an option such as --upload-pack=...), and the fetch passes -- before its positional arguments.
• GIT_ALLOW_PROTOCOL restricts git to https and ssh (no file://, ext:: or other transports). SLOPGUARD_GIT_ALLOW_PROTOCOL overrides the list; it exists for tests and CI that serve rules from file:// remotes.
• A ref that is not a full 40-character commit sha is floating: the rules it loads can change under the user, so the CLI warns about it (unpinned_source_warnings). A pinned sha already checked out in the cache is reused without touching the network.
• Refreshing an existing cache when online must succeed: a failed fetch fails the resolution instead of silently scanning with stale rules.

Git auth is delegated to the machine’s own git (ssh-agent, credential helper, ~/.gitconfig). SLOPGUARD_GIT_TOKEN overrides that for https URLs of a single trusted host (SLOPGUARD_GIT_TOKEN_HOST, else [git] token_host in the user config): the token is injected into the transient git fetch <url> argument only, never into the persisted remote, so no token is written to disk. Without a configured host, no token is injected.

Structs

GitToken

An https token together with the single host it may be sent to.

ResolvedSource

A source resolved to a directory on disk plus the provenance of its rules.

SourceOptions

How git sources are cached, fetched and authenticated.

Enums

RuleOrigin

Where a rule came from, tracked so slopguard list can show provenance.

SourceError

Constants

DEFAULT_ALLOWED_PROTOCOLS

Protocols git may use to fetch a source unless overridden.

Functions

default_allowed_protocols

The protocols git may use for sources: $SLOPGUARD_GIT_ALLOW_PROTOCOL when set, otherwise DEFAULT_ALLOWED_PROTOCOLS.

default_cache_root

Default cache location for git sources: $SLOPGUARD_SOURCES_CACHE when set, otherwise <user cache>/slopguard/sources.

git_token_from_env

Read the git token from SLOPGUARD_GIT_TOKEN, bound to the host named by SLOPGUARD_GIT_TOKEN_HOST, else config_host ([git] token_host).

is_pinned_sha

Whether git_ref is a full 40-character hex commit sha, i.e. a pinned ref whose content cannot change.

resolve_sources

Resolve every configured source to a directory and its provenance.

unpinned_source_warnings

One warning per git source whose ref is missing or is not a pinned commit sha. The URL is printed without its userinfo, so no credential leaks.