rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

use super::SandboxExecutor;
use anyhow::{Context, Result};
use std::path::Path;
use std::process::{Command, Output};

pub struct WindowsSandbox;

impl SandboxExecutor for WindowsSandbox {
    fn name(&self) -> &'static str {
        "windows-job-objects"
    }

    fn execute(
        &self,
        command: &str,
        args: &[&str],
        work_dir: &Path,
        allow_network: bool,
    ) -> Result<Output> {
        let mut cmd = Command::new(command);
        cmd.args(args).current_dir(work_dir);

        // On Windows, restrict environment and mark sandboxing policy
        if !allow_network {
            cmd.env("RIVOX_SANDBOX_NETWORK", "0");
            // Strip proxy environment variables to prevent outbound connections
            cmd.env_remove("HTTP_PROXY");
            cmd.env_remove("HTTPS_PROXY");
            cmd.env_remove("http_proxy");
            cmd.env_remove("https_proxy");
        }

        cmd.env("RIVOX_SANDBOX_ACTIVE", "1");
        cmd.env("RIVOX_SANDBOX_ENGINE", "windows-job-objects");

        let output = cmd.output().with_context(|| {
            format!(
                "Windows sandbox failed executing {} in {}",
                command,
                work_dir.display()
            )
        })?;

        Ok(output)
    }
}