mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
4600ab0245
* fix: Sandbox policy tuning for tmp write access * fix: Remove numbers from test * Update sandbox/profiles/pnpm-restrictive.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * fix: Sandbox E2E test to consider Linux bubblewrap tmpfs mount * Update sandbox/profiles/pnpm-restrictive.yml Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * fix: Migrate deny rules from pnpm to npm policy --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
26 lines
664 B
YAML
26 lines
664 B
YAML
name: pnpm-restrictive
|
|
description: Profile for pnpm with write access to current directory
|
|
inherits: npm-restrictive
|
|
|
|
package_managers:
|
|
- pnpm
|
|
|
|
filesystem:
|
|
allow_write:
|
|
# pnpm needs write access here
|
|
- ${HOME}/Library/pnpm/.tools/**
|
|
- ${HOME}/.pnpm-store/**
|
|
|
|
# `pnpm i` creates the tmp files in local dir, at least on MacOS
|
|
- ${CWD}/_tmp_*
|
|
|
|
# pnpm self-update (or likely update) creates temporary package.json files
|
|
# for writing. This is likely for atomic update using filesystem rename operation
|
|
# which guarantees atomicity
|
|
- ${CWD}/package.json.*
|
|
|
|
# Need access for dependency resolution
|
|
- ${CWD}/.pnpm-store
|
|
|
|
|