PassiveRulesUpdater

Default location for the image-baked ruleset. Resolves via bundled_rules_path so specs (and adventurous packagers) can point at a different prefix with NOIR_BUNDLED_RULES_PATH.

Upper bound on any single git call. A blackholed remote otherwise blocks git fetch / clone for the whole TCP connect timeout, and noir scan -P runs the fetch before it does anything else. Override with NOIR_RULES_GIT_TIMEOUT (seconds).

Force git into non-interactive mode so a missing/expired credential never drops the scan into an invisible username/password prompt that blocks forever (CI, automation). git exits with an error instead.

How long a scan trusts the last git fetch of the rules. Every -P scan used to fetch before doing anything else — about half a second on a good network, up to git_timeout on a bad one, for rules that change a few times a month.

True when the image-baked ruleset is available and the user hasn't provided their own. Callers use this to skip the git-clone fallback (which costs network + a git binary the image doesn't ship).

Image-baked rules location. The official Docker image clones noir-passive-rules at build time and drops the result here so noir scan -P Just Works without network or git. Bare installs (homebrew / snap / source) won't have this path — user_rules_path wins on those.

Check if the passive rules directory is a git repository and needs updates.

With fetch_interval, the network fetch is skipped when the last one (.git/FETCH_HEAD) is younger than that; the behind-count still comes from the local origin/main, so a stale-rules notice keeps appearing.

Where noir scan -P should actually read rules from. Preference order: user-managed path (so user-added rules and rules update both win) → bundled image path → user path (gives the clone fallback in initialize_rules something concrete to populate).

Initialize passive rules if they don't exist

Runs git with GIT_ENV, bounded by git_timeout. A call that overruns is terminated and reported as a warning, so callers fall back to the cached rules (or fail noir rules update) instead of hanging.

The user-managed rules path: where noir rules update clones to, where noir rules path reports, and the canonical writable location an end-user owns. Kept out of effective_rules_path so the CLI rules subcommand has a stable single answer.