fix(sandbox): deny SSH private keys and the GPG keyring - #990

Open

cairn-intern wants to merge 9 commits into

Gitlawb:mainfrom

cairn-intern:fix/815-ssh-gpg-deny

Commits on Aug 28, 2026

fix(sandbox): deny SSH private keys and the GPG keyring
cairn-intern
committed
9d480d3
fix(sandbox): expand SSH %d and keep lexical credential denies
cairn-intern
committed
14e64f1
fix(sandbox): keep lexical credential denies through bwrap and Seatbelt
cairn-intern
committed
77eacc6
fix(sandbox): follow SSH config symlinks and keep lexical dir dests
cairn-intern
committed
ecf2d02
fix(sandbox): dual-add lexical dests only when a symlink is involved
cairn-intern
committed
64cdf84
fix(sandbox): bound SSH walks and honor nested GPG allowRead
cairn-intern
committed
6e0da5d
fix(sandbox): sniff .pub keys, expand ${HOME}, mask symlink dests
cairn-intern
committed
6f3de51
fix(sandbox): skip overlaid file binds and sniff named keys
cairn-intern
committed
0810f60
fix(sandbox): bind when overlay fails; sniff named IdentityFiles
cairn-intern
committed
5395f19