mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
c7244f921a
* feat: Add support for environment variable protection for sandbox * chore: Update dangerous env var list * fix: Split profiles for improved environment protection * fix: pipx sandbox profile separation * chore: Show sandbox scrub info on error exit * fix: Code review fixes * test: Add e2e for sandbox environment scrubbing
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
name: pnpm
|
|
description: Profile for pnpm, extending npm-restrictive with pnpm write paths and environment variables
|
|
inherits: npm-restrictive
|
|
|
|
package_managers:
|
|
- pnpm
|
|
|
|
environment:
|
|
# The npm-restrictive base allows no environment variables. pnpm uses the
|
|
# npm auth and config conventions (.npmrc with env interpolation,
|
|
# npm_config_*). Sibling tokens (YARN_NPM_AUTH_*, BUN_AUTH_TOKEN) stay
|
|
# scrubbed.
|
|
allow:
|
|
- NPM_TOKEN
|
|
- NPM_AUTH_TOKEN
|
|
- NODE_AUTH_TOKEN
|
|
- npm_config_*
|
|
- NPM_CONFIG_*
|
|
- NODE_EXTRA_CA_CERTS
|
|
|
|
filesystem:
|
|
allow_write:
|
|
# pnpm needs write access here
|
|
- ${HOME}/Library/pnpm/.tools/**
|
|
- ${HOME}/.pnpm-store/**
|
|
|
|
# `pnpm i` creates the tmp files in local dir, at least on MacOS
|
|
- ${CWD}/_tmp_*
|
|
|
|
# pnpm self-update (or likely update) creates temporary package.json files
|
|
# for writing. This is likely for atomic update using filesystem rename operation
|
|
# which guarantees atomicity
|
|
- ${CWD}/package.json.*
|
|
|
|
# pnpm install/update writes pnpm-lock.yaml atomically via a sibling
|
|
# temp file (e.g. pnpm-lock.yaml.139703784) followed by rename.
|
|
- ${CWD}/pnpm-lock.yaml.*
|
|
|
|
# Need access for dependency resolution
|
|
- ${CWD}/.pnpm-store
|
|
|
|
|