mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
090a7b622b
* refactor(nixpak): split policy checks into per-app suites Make hardening/tests/policy.nix a small loader that auto-discovers one suite per app under hardening/tests/policy. Shared checks live in policy-lib.nix and common expectations are generated by mkAppPolicy; app files only declare differences and special cases. The loader also discovers wrappers from hardening/nixpaks and fails when wrapper/suite inventory or check names diverge. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): reject duplicate per-app policy checks mkAppPolicy merges generated and custom checks, so an extraChecks key could silently override a standard assertion. Fail explicitly when a per-app check name is defined twice. Assisted-by: DeepSeek Harness (deepseek-flash)
11 lines
203 B
Nix
11 lines
203 B
Nix
{ mkAppPolicy, ... }:
|
|
mkAppPolicy "brave-origin" {
|
|
network = "pasta";
|
|
media = false;
|
|
mpris = false;
|
|
notifications = true;
|
|
personalFiles = false;
|
|
browserpass = false;
|
|
secretPortal = true;
|
|
}
|