harn-vm 0.10.152

Async bytecode virtual machine for the Harn programming language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

# Credential material a confined child process may never read.
#
# Data, not code: adding a path here is a reviewable one-line diff, and nothing
# in the Rust module decides what belongs on this list.
#
# Every entry is home-relative, and every one of them sits under a directory
# some preset already grants. `PackageManagerConfig` opens `~/.config`,
# `~/.cache`, and `~/.netrc` wholesale; `DeveloperToolchains` opens the home
# toolchain roots. Naming a parent readable is not consent to read the
# credentials inside it, which is why this list beats the presets rather than
# competing with them.
#
# A host may ADD denials through `ProcessSandboxPolicy::read_deny_roots`. It
# cannot remove these.

[defaults]
home_relative = [
  ".ssh",
  ".aws",
  ".gnupg",
  ".netrc",
  ".docker/config.json",
  ".config/gh/hosts.yml",
  ".config/gcloud",
  ".kube/config",
  ".npmrc",
  ".pypirc",
  ".cargo/credentials",
  ".cargo/credentials.toml",
  ".composer/auth.json",
  ".config/composer/auth.json",
  ".config/git/credentials",
  ".config/glab-cli",
  ".config/hub",
  ".config/github-copilot",
  ".config/rclone/rclone.conf",
  ".config/doctl",
  ".config/hcloud",
  ".config/containers/auth.json",
  ".config/.wrangler",
  ".config/stripe",
  ".config/sops/age",
  ".config/configstore/firebase-tools.json",
  ".cache/huggingface/token",
  ".cache/huggingface/stored_tokens",
]

# Why each entry is here, for review. Absent keys are not an error; this table
# is documentation that lives next to the data instead of drifting from it.
[reason]
".ssh" = "private keys and known_hosts"
".aws" = "long-lived access keys and session tokens"
".gnupg" = "private keyring"
".netrc" = "plaintext machine credentials; granted by PackageManagerConfig"
".docker/config.json" = "registry auth tokens"
".config/gh/hosts.yml" = "GitHub OAuth token; under preset-granted ~/.config"
".config/gcloud" = "Google Cloud credentials; under preset-granted ~/.config"
".kube/config" = "cluster credentials and client certs"
".npmrc" = "registry auth tokens"
".pypirc" = "package index upload credentials"
".cargo/credentials" = "crates.io API token"
".cargo/credentials.toml" = "crates.io API token"
".composer/auth.json" = "Packagist and GitHub OAuth tokens; under preset-granted ~/.composer"
".config/composer/auth.json" = "the same tokens in Composer's XDG layout; under preset-granted ~/.config"
".config/git/credentials" = "git credential-store tokens in the XDG layout; under preset-granted ~/.config"
".config/glab-cli" = "GitLab CLI tokens (config.yml); under preset-granted ~/.config"
".config/hub" = "hub CLI OAuth token; under preset-granted ~/.config"
".config/github-copilot" = "Copilot OAuth tokens (hosts.json, apps.json); under preset-granted ~/.config"
".config/rclone/rclone.conf" = "remote storage credentials; under preset-granted ~/.config"
".config/doctl" = "DigitalOcean API token; under preset-granted ~/.config"
".config/hcloud" = "Hetzner Cloud API tokens; under preset-granted ~/.config"
".config/containers/auth.json" = "Podman and Buildah registry auth; under preset-granted ~/.config"
".config/.wrangler" = "Cloudflare Wrangler OAuth tokens; under preset-granted ~/.config"
".config/stripe" = "Stripe CLI API keys; under preset-granted ~/.config"
".config/sops/age" = "age private keys for sops; under preset-granted ~/.config"
".config/configstore/firebase-tools.json" = "Firebase CLI refresh token; under preset-granted ~/.config"
".cache/huggingface/token" = "Hugging Face access token (HF_HOME default); under preset-granted ~/.cache"
".cache/huggingface/stored_tokens" = "Hugging Face saved access tokens; under preset-granted ~/.cache"