Add .swiftpm/config/registries.json to default .gitignore

[mattt]

This PR adds .swiftpm/config to the .gitignore file in the new project template.

Motivation:

As discussed in SE-0292, a user may inadvertently reveal the existence of a private registry or expose hardcoded credentials by checking in their project's .swiftpm/config file or directory. Adding this entry to the .gitignore file in the new project template significantly minimize the possibility of the user leaking credentials in the future.

Modifications:

+ .swiftpm/config

Result:

After this change, all future projects created by running swift package init will default to ignoring .swiftpm/config files (which covers both the file .swiftpm/config if it's a file, and the contents of the directory if .swiftpm/config/ is a directory).

Existing packages will be unaffected.

[mattt]

@swift-ci please smoke test

[neonichu]

I'm not sure I agree with this. If we think the per-package config cannot be checked in, it basically has zero value and shouldn't exist in the first place.

[mattt]

@neonichu Adding .swiftpm/config to the default .gitignore file doesn't stop users from checking those files into version control. They could accomplish that by either:

1. Removing that line from their .gitignore after generating their project, or
2. Force-adding (git add .swiftpm/config --force)

Also, there are plenty of examples across various ecosystems of files that provide local configuration that aren't checked into source control, such as .env files.

Swift Package Manager has used local configuration files in .swiftpm/config for a while now, and I don't think anyone has proposed removing it anytime soon. The current behavior has been identified by folks like @Lukasa as being a security risk. This PR provides a better, more secure default until such time that we decide to change how configuration works in SwiftPM.

[tomerd]

I agree with @neonichu here. adding this categorically can be unexpected behavior, and this is not enough as security mitigation for credential handling discussed on SE-0292

[mattt]

I agree with @neonichu here. adding this categorically can be unexpected behavior

For what it's worth, Swift Package Manager itself ignores the .swiftpm directory entirely.

If you look at GitHub's own repository of recommended .gitignore files, you can find plenty of examples of configuration files being ignored by default.

[T]his is not enough as security mitigation for credential handling discussed on SE-0292

There are reasons to ignore configuration beyond leaking credentials, which I articulate here:

Denial of service

An attacker could scrape public code repositories
for .swiftpm/config/registries.json files
that declare one or more custom registries
and launch a denial-of-service attack
in an attempt to reduce the availability of those resources.

[tomerd]

hi @mattt coming back to this, I think a balanced solution could be to to add .swiftpm/config/registries.json to .gitignore instead of the entire swiftpm/config directory. would you prefer to adjust this PR or make it part of the PR that brings SE-0292 in?

[mattt]

@tomerd I just pushed 3325616, which makes this change.

[mattt]

@swift-ci Please smoke test