Skip to content

Package restricted-1.1 #29182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mseri merged 2 commits into from
Jan 8, 2026
Merged

Package restricted-1.1 #29182

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd71999
add ocaml-restricted-1.1
stopusingghpls Jan 4, 2026
2533a2e
Apply suggestion from @mseri
mseri Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions packages/restricted/restricted.1.1/opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# This file is generated by dune, edit dune-project instead
opam-version: "2.0"
synopsis:
"Restrict possible system operations and filesystem view of your program"
description: """
Try to call it as soon as possible in your program. Actual restricted calls currently implemented for these operating systems:

- OpenBSD

Even if your operating system is not currently actually implemented, you can still call 'restricted' to make transparent to your users which priviliges your program needs and your users can test these promises with tools like (pledge on Linux)[https://justine.lol/pledge/]. Enjoy ;)"""
maintainer: ["Remove Wingman <[email protected]>"]
authors: ["Remove Wingman <[email protected]>"]
license: "AGPL-3.0-or-later"
tags: ["openbsd" "restricted"]
homepage: "https://codeberg.org/removewingman/restricted"
bug-reports: "https://codeberg.org/removewingman/restricted/issues"
depends: [
"ocaml" {>= "5.1.0"}
"dune" {>= "3.17"}
"ppx_inline_test"
"odoc" {with-doc}
]
build: [
["dune" "subst"] {dev}
[
"dune"
"build"
"-p"
name
"-j"
jobs
"@install"
"@runtest" {with-test}
"@doc" {with-doc}
]
]
dev-repo: "git+https://codeberg.org/removewingman/restricted.git"
Copy link
Member

@mseri mseri Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

available: os = "openbsd" | os = "linux"
dev-repo: "git+https://codeberg.org/removewingman/restricted.git"

I would make this available on openbsd and linux, or pledge to check the resources is also available on other systems?

Copy link
Contributor Author

@stopusingghpls stopusingghpls Jan 6, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the dune fix.
I don't know what you mean by:

or pledge to check the resources is also available on other systems?

The idea is to give people the option to specify which privileges there program will need, the actual restriction will be implemented from time to time, it cross platform, since the c call will not be called on e.g. windows:

Copy link
Member

@mseri mseri Jan 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, what I meant is that as you say and as you do in https://codeberg.org/removewingman/restricted/src/branch/main/lib/restricted.ml#L107, only on openbsd the restricion are applied. I thought on other platform it was not possilbe to check if the privileges were respected or not, perhaps with the exception of linux where you can use the linked pledge.

In that sense I was wondering if it was better to make it available only on the platform where the library is actually doing something. But I understand in the meantime you write the permission requirements and then, if at some point it can be implemented on your platform, you can make it check

Copy link
Contributor Author

@stopusingghpls stopusingghpls Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So is it fine like that or do you still want it changed?

Copy link
Member

@mseri mseri Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is all right as is. I thought I had merged yesterday already, sorry

url {
src: "https://codeberg.org/removewingman/restricted/releases/download/v1.1/ocaml-restricted-1.1.tar.gz"
checksum: [
"md5=8640c49d4b7e84deb1b60a105bdd338c"
"sha512=43243183b459398524415c6dd5583639c4a57612b17e0f295dfd878ae075445d3e3f3df1aad2841e0abf29a75a317dd8d6f1c1dd18469e47d01140aa51d41f50"
]
}