Repository: lima-vm/lima

Issue:
Create warning when `LIMA_SHELLENV_BLOCK` is ignored
> I think if both `LIMA_SHELLENV_BLOCK` and `LIMA_SHELLENV_ALLOW` are set simultaneously, then the former should be ignored (with a warning). 

 _Originally posted by @jandubois in [#3430](https://github.com/lima-vm/lima/issues/3430#issuecomment-2807723196)_


Discussion:
@zyfy29: I could be of help to implement this. Could you assign it to me?

Solution patch:
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 3921dc83..f9561c16 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -32,7 +32,7 @@ jobs:
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@96f518a34f7a870018057716cc4d7a5c014bd61c  # v3.29.5
+      uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498  # v3.29.5
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@96f518a34f7a870018057716cc4d7a5c014bd61c  # v3.29.5
+      uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ea94d8fd..f3406e91 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
     # Upload the results to GitHub's code scanning dashboard (optional).
     # Commenting out will disable upload of results to your repo's Code Scanning dashboard
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@96f518a34f7a870018057716cc4d7a5c014bd61c  # v3.29.5
+      uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498  # v3.29.5
       with:
         sarif_file: results.sarif
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 53dcf5ae..b39384d8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -470,6 +470,8 @@ jobs:
         brew install bash coreutils
         # QEMU 9.1.0 seems to break on GitHub runners, both on Monterey and Ventura
         # We revert back to 8.2.1, which seems to work fine
+        git config --global user.name "GitHub Actions Bot"
+        git config --global user.email "nobody@localhost"
         ./hack/brew-install-version.sh qemu 8.2.1
     - name: Test
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
diff --git a/go.mod b/go.mod
index d887efe9..315907b0 100644
--- a/go.mod
+++ b/go.mod
@@ -46,7 +46,7 @@ require (
 	golang.org/x/sys v0.35.0 // gomodjail:unconfined
 	golang.org/x/text v0.28.0
 	google.golang.org/grpc v1.74.2
-	google.golang.org/protobuf v1.36.7 // gomodjail:unconfined
+	google.golang.org/protobuf v1.36.8 // gomodjail:unconfined
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
 	gotest.tools/v3 v3.5.2
 	k8s.io/api v0.33.4
diff --git a/go.sum b/go.sum
index 88382246..b41c32d1 100644
--- a/go.sum
+++ b/go.sum
@@ -416,8 +416,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
 google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 30ffc046..7c8be82f 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -15,7 +15,7 @@ tool (
 require (
 	github.com/containerd/ltag v0.3.0
 	github.com/golangci/golangci-lint/v2 v2.4.0
-	github.com/yoheimuta/protolint v0.55.6
+	github.com/yoheimuta/protolint v0.56.3
 	google.golang.org/grpc v1.75.0
 	google.golang.org/protobuf v1.36.7
 	mvdan.cc/sh/v3 v3.12.0
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 38bb72a3..b8ccf63b 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -632,8 +632,8 @@ github.com/ykadowak/zerologlint v0.1.5 h1:Gy/fMz1dFQN9JZTPjv1hxEk+sRWm05row04Yoo
 github.com/ykadowak/zerologlint v0.1.5/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg=
 github.com/yoheimuta/go-protoparser/v4 v4.14.2 h1:/P/LlX1CF9NaTWEltGcIZVvNlPbhABuAnBtAWpb3+74=
 github.com/yoheimuta/go-protoparser/v4 v4.14.2/go.mod h1:AHNNnSWnb0UoL4QgHPiOAg2BniQceFscPI5X/BZNHl8=
-github.com/yoheimuta/protolint v0.55.6 h1:vEDWGz768e3LDxMoOUC8fDQDdXnH9JKV/k9rlHD+ZhY=
-github.com/yoheimuta/protolint v0.55.6/go.mod h1:XrnOc0O5mckLR1GAOjqMPdb3R3ZEfLkMpLoq5RxxoG0=
+github.com/yoheimuta/protolint v0.56.3 h1:BUe3HFUHNsindB+UIRk9m/tn8nuKCqCdNkF2Nt01S9Y=
+github.com/yoheimuta/protolint v0.56.3/go.mod h1:XrnOc0O5mckLR1GAOjqMPdb3R3ZEfLkMpLoq5RxxoG0=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
diff --git a/pkg/envutil/envutil.go b/pkg/envutil/envutil.go
index 50625336..023b9e0e 100644
--- a/pkg/envutil/envutil.go
+++ b/pkg/envutil/envutil.go
@@ -42,23 +42,27 @@ var defaultBlockList = []string{
 	"_*", // Variables starting with underscore are typically internal
 }
 
-func getBlockList() []string {
+// getBlockList returns the list of environment variable patterns to be blocked.
+// The second return value indicates whether the list was explicitly set via LIMA_SHELLENV_BLOCK.
+func getBlockList() ([]string, bool) {
 	blockEnv := os.Getenv("LIMA_SHELLENV_BLOCK")
 	if blockEnv == "" {
-		return defaultBlockList
+		return defaultBlockList, false
 	}
 	after, found := strings.CutPrefix(blockEnv, "+")
 	if !found {
-		return parseEnvList(blockEnv)
+		return parseEnvList(blockEnv), true
 	}
-	return slices.Concat(defaultBlockList, parseEnvList(after))
+	return slices.Concat(defaultBlockList, parseEnvList(after)), true
 }
 
-func getAllowList() []string {
+// getAllowList returns the list of environment variable patterns to be allowed.
+// The second return value indicates whether the list was explicitly set via LIMA_SHELLENV_ALLOW.
+func getAllowList() ([]string, bool) {
 	if allowEnv := os.Getenv("LIMA_SHELLENV_ALLOW"); allowEnv != "" {
-		return parseEnvList(allowEnv)
+		return parseEnvList(allowEnv), true
 	}
-	return nil
+	return nil, false
 }
 
 func parseEnvList(envList string) []string {
@@ -92,10 +96,17 @@ func matchesAnyPattern(name string, patterns []string) bool {
 // It returns a slice of environment variables that are not blocked by the current configuration.
 // The filtering is controlled by LIMA_SHELLENV_BLOCK and LIMA_SHELLENV_ALLOW environment variables.
 func FilterEnvironment() []string {
+	allowList, isAllowListSet := getAllowList()
+	blockList, isBlockListSet := getBlockList()
+
+	if isBlockListSet && isAllowListSet {
+		logrus.Warn("Both LIMA_SHELLENV_BLOCK and LIMA_SHELLENV_ALLOW are set. Block list will be ignored.")
+		blockList = nil
+	}
 	return filterEnvironmentWithLists(
 		os.Environ(),
-		getAllowList(),
-		getBlockList(),
+		allowList,
+		blockList,
 	)
 }
 



Test patch:
diff --git a/pkg/envutil/envutil_test.go b/pkg/envutil/envutil_test.go
index a0ff3399..b6fb37ea 100644
--- a/pkg/envutil/envutil_test.go
+++ b/pkg/envutil/envutil_test.go
@@ -88,9 +88,11 @@ func TestGetBlockAndAllowLists(t *testing.T) {
 		t.Setenv("LIMA_SHELLENV_BLOCK", "")
 		t.Setenv("LIMA_SHELLENV_ALLOW", "")
 
-		blockList := getBlockList()
-		allowList := getAllowList()
+		blockList, isBlockListSet := getBlockList()
+		allowList, isAllowListSet := getAllowList()
 
+		assert.Assert(t, !isBlockListSet)
+		assert.Assert(t, !isAllowListSet)
 		assert.Assert(t, isUsingDefaultBlockList())
 		assert.DeepEqual(t, blockList, defaultBlockList)
 		assert.Equal(t, len(allowList), 0)
@@ -99,7 +101,8 @@ func TestGetBlockAndAllowLists(t *testing.T) {
 	t.Run("custom blocklist", func(t *testing.T) {
 		t.Setenv("LIMA_SHELLENV_BLOCK", "PATH,HOME")
 
-		blockList := getBlockList()
+		blockList, isSet := getBlockList()
+		assert.Assert(t, isSet)
 		assert.Assert(t, !isUsingDefaultBlockList())
 		expected := []string{"PATH", "HOME"}
 		assert.DeepEqual(t, blockList, expected)
@@ -108,7 +111,8 @@ func TestGetBlockAndAllowLists(t *testing.T) {
 	t.Run("additive blocklist", func(t *testing.T) {
 		t.Setenv("LIMA_SHELLENV_BLOCK", "+CUSTOM_VAR")
 
-		blockList := getBlockList()
+		blockList, isSet := getBlockList()
+		assert.Assert(t, isSet)
 		assert.Assert(t, isUsingDefaultBlockList())
 		expected := slices.Concat(GetDefaultBlockList(), []string{"CUSTOM_VAR"})
 		assert.DeepEqual(t, blockList, expected)
@@ -117,7 +121,8 @@ func TestGetBlockAndAllowLists(t *testing.T) {
 	t.Run("allowlist", func(t *testing.T) {
 		t.Setenv("LIMA_SHELLENV_ALLOW", "FOO,BAR")
 
-		allowList := getAllowList()
+		allowList, isSet := getAllowList()
+		assert.Assert(t, isSet)
 		expected := []string{"FOO", "BAR"}
 		assert.DeepEqual(t, allowList, expected)
 	})