WUT_Computer_Science/.binary-allowlist
Krzysztof kuhy Rudnicki 94f965fe3a Add the no-binaries gate with a path-scoped allowlist
621 binaries are tracked here and they are supposed to be: 155 PDFs, 275
PNGs, 68 JPGs, the submitted reports and figures. Decision 3 keeps them and
skips the history rewrite, so a blanket block would be wrong. What the gate
is for is stopping NEW junk.

So the allowlist is scoped by path rather than by extension alone. Documents,
figures and datasets are allowed under Programming/ and NotProgramming/;
compiled output (.o .so .a .exe .dll .dylib .class .pyc) is allowed nowhere
and has no entry at all; and the repo root, gates/, scripts/ and .github/
have no entry either, so a binary dropped in the tooling directories is
blocked. The .tgz entries are load-bearing -- EOPSY ships its simulators as
ftp/{sched,memory}.tgz and `make setup` extracts them.

Verified three ways, because a gate that passes everything is vacuous:
  - all 2749 tracked files          -> exit 0
  - probe.exe at root, probe.png in gates/ -> BLOCKED, exit 1
  - a real submitted PDF            -> exit 0
plus shellcheck clean.

The script is a copy of testsAndMisc's, which is where this gate lives today
-- it is not in the shared ~/utils set. The header says so and says to move
it to ~/utils rather than let the two drift, since a hand-copied gate is what
produced four forks of the 250-line cap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 17:37:53 +02:00

73 lines
2.5 KiB
Plaintext

# Binary files this repo commits on purpose. One bash glob per line.
#
# Read by scripts/check_no_binaries.sh. Note that matching uses bash `case`,
# where `*` DOES cross `/` -- so `Programming/*.pdf` matches a .pdf at any
# depth under Programming/.
#
# Policy for this repo (approved decision 3). This is an archive of submitted
# university coursework: the reports, figures, schematics and datasets ARE the
# deliverable, so they stay, and history is not rewritten. What the gate is
# actually here to stop is NEW junk -- compiled output, and binaries dropped
# into the tooling directories.
#
# So the allowlist is scoped by PATH, not blanket:
# - documents/figures/data are allowed under Programming/ and NotProgramming/
# - compiled output (.o .so .a .exe .dll .dylib .class .pyc .pyo) is allowed
# NOWHERE, and has no entry below. 189 such files were untracked in
# d4075278; .gitignore keeps them out.
# - the repo root, gates/, scripts/ and .github/ have no entry either, so a
# binary added there is blocked.
#
# Every pattern here must also survive `git ls-files | git check-ignore
# --stdin --no-index` printing nothing -- an allowlisted file that .gitignore
# also matches fails silently on `git add` rather than erroring.
# --- Reports and presentations (155 .pdf, 3 .docx, 1 .doc, 1 .pptx) ---------
Programming/*.pdf
NotProgramming/*.pdf
Programming/*.doc
NotProgramming/*.doc
Programming/*.docx
NotProgramming/*.docx
Programming/*.ppt
NotProgramming/*.ppt
Programming/*.pptx
NotProgramming/*.pptx
# --- Figures, screenshots, schematics (275 .png, 68 .jpg, 52 .gif, ...) -----
Programming/*.png
NotProgramming/*.png
Programming/*.jpg
NotProgramming/*.jpg
Programming/*.jpeg
NotProgramming/*.jpeg
Programming/*.gif
NotProgramming/*.gif
Programming/*.bmp
NotProgramming/*.bmp
Programming/*.svg
NotProgramming/*.svg
Programming/*.webp
NotProgramming/*.webp
Programming/*.ico
NotProgramming/*.ico
Programming/*.tif
NotProgramming/*.tif
Programming/*.tiff
NotProgramming/*.tiff
# --- Fonts shipped inside a submitted project ------------------------------
Programming/*.ttf
NotProgramming/*.ttf
# --- Datasets and course-supplied archives ---------------------------------
# The .tgz entries matter: EOPSY ships its simulators as ftp/sched.tgz and
# ftp/memory.tgz, and `make setup` extracts them. Blocking those would break
# the lab. The .zip files are submitted result bundles and course inputs.
Programming/*.zip
NotProgramming/*.zip
Programming/*.tgz
NotProgramming/*.tgz
Programming/*.bin
NotProgramming/*.bin