7c11ed1d8d
Adds macOS sandboxing support similar to Linux bubblewrap implementation: - Created clan_lib/sandbox_exec module with sandbox profile creation - Implemented file system isolation allowing only tmpdir and nix store access - Added network restrictions (deny outbound except localhost) - Integrated sandbox-exec command into vars generation on macOS - Added comprehensive test suite for macOS sandbox functionality - Fixed working directory handling for generators writing to CWD
clan-cli
The Clan CLI contains the command line interface.
Hacking on the CLI
We recommend setting up direnv to load the development with Nix.
If you do not have it set up you can also use nix develop directly like this:
use flake .#clan-cli --builders ''
After you can use the local bin wrapper to test things in the CLI:
./bin/clan
Run locally single-threaded for debugging
By default tests run in parallel using pytest-parallel.
pytest-parallel however breaks breakpoint(). To disable it, use this:
pytest -n0 -s
You can also run a single test like this:
pytest -n0 -s tests/test_secrets_cli.py::test_users
Run tests in nix container
Run all impure checks
nix run .#impure-checks
Run all checks
nix flake check