From 12292469263039ea9c1deee3c85268e3fea515dc Mon Sep 17 00:00:00 2001 From: Abhisek Datta Date: Fri, 9 Jan 2026 12:26:52 +0530 Subject: [PATCH] Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta --- config/config.template.yml | 3 ++- sandbox/executor/apply.go | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/config/config.template.yml b/config/config.template.yml index fd3beda..2c7dd51 100644 --- a/config/config.template.yml +++ b/config/config.template.yml @@ -52,7 +52,8 @@ trusted_packages: # filesystem, network, and process execution access. This provides defense-in-depth # protection against malicious install scripts and supply chain attacks. # -# Policy violations will block execution (this is the only supported behavior). +# When sandboxing is enabled for a package manager, policy violations will block execution +# (no "warn-only" mode). Sandboxing itself can be disabled globally or per package manager. # # Currently supported platforms: # - macOS (using Seatbelt sandbox-exec) diff --git a/sandbox/executor/apply.go b/sandbox/executor/apply.go index 5b8cd23..453db10 100644 --- a/sandbox/executor/apply.go +++ b/sandbox/executor/apply.go @@ -75,7 +75,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.E } if !sb.IsAvailable() { - return nil, fmt.Errorf("sandbox %s not available, running without sandbox", sb.Name()) + return nil, fmt.Errorf("sandbox %s is required but not available", sb.Name()) } log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)