Repositories are ones the team allows
clojure/repositories-allowed@v1
Every Maven repository the manifest adds beyond the defaults resolves from a host on the allowed list.
| Id | clojure/repositories-allowed |
| Version | v1 |
| Category | clojure |
| Default severity | error |
| Interpreter | python3 |
| Timeout | 30 seconds |
| Violations tolerated | 0 |
| Collects | clojure |
Collectors
This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.
| Collector | Gathers | Inputs it is given |
|---|---|---|
clojure | The Clojure build in the project directory: which tool it uses, the Clojure version it depends on, the source paths and aliases it declares, the repositories it resolves from, and every dependency with its alias, origin and whether it is pinned. | projectDir |
The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.
Configuration
{
"guardrails": {
"failOn": "error",
"comment": true,
"checks": [
{
"use": "clojure/repositories-allowed@v1",
"severity": "error",
"with": {
"projectDir": ".",
"allowedHosts": "repo1.maven.org,repo.clojars.org,clojars.org,central.sonatype.com"
},
"exemptions": []
}
]
}
}Inputs
| Input | Description | Default | Environment variable |
|---|---|---|---|
projectDir | Directory holding the project, relative to the directory the CLI runs in. | . | GUARDRAIL_INPUT_PROJECTDIR |
allowedHosts | Comma separated hosts a repository may resolve from. A repository on any other host is a violation. | repo1.maven.org,repo.clojars.org,clojars.org,central.sonatype.com | GUARDRAIL_INPUT_ALLOWEDHOSTS |
How to fix
Resolve from hosts the team has vetted, and give every entry the URL it resolves from:
{:mvn/repos {"clojars" {:url "https://repo.clojars.org/"}}}Add an internal mirror to allowedHosts rather than leaving it unnamed. A repository nobody vetted is what a dependency confusion attack needs: a package published under your coordinates on a host the build happens to reach is resolved as if it were yours, and an entry with no :url says nothing at all about where its artifacts come from.
More in clojure
clojure/dependencies-pinned. Every dependency the manifests declare names one released version, or the exact commit a git dependency builds from.clojure/no-local-dependencies. No dependency is taken from a:local/root, so the build resolves everything from this commit rather than from the machine it runs on.clojure/version-declared. The project depends on the Clojure release it is built against, and that release is no older than the configured floor.