Skip to content

Commit 2b4c6a5

Browse files
brianwtaylorbrianwtaylor
committed
feat: add cargo, go, apt, and ghcr policy presets
Add network policy presets for Rust Cargo, Go modules, Debian/Ubuntu apt repositories, and GitHub Container Registry. Each follows the existing YAML schema with minimal required permissions (GET-only for package registries, GET+POST for auth token exchange on GHCR). Signed-off-by: Brian Taylor <brian@briantaylor.xyz> Signed-off-by: Brian Taylor <brian.taylor818@gmail.com>
1 parent 2a9afbc commit 2b4c6a5

5 files changed

Lines changed: 150 additions & 3 deletions

File tree

‎nemoclaw-blueprint/policies/presets/apt.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
preset:
5+
name: apt
6+
description: "Debian and Ubuntu package repositories"
7+
8+
network_policies:
9+
apt_repositories:
10+
name: apt_repositories
11+
endpoints:
12+
- host: archive.ubuntu.com
13+
port: 443
14+
protocol: rest
15+
enforcement: enforce
16+
tls: terminate
17+
rules:
18+
- allow: { method: GET, path: "/**" }
19+
- host: security.ubuntu.com
20+
port: 443
21+
protocol: rest
22+
enforcement: enforce
23+
tls: terminate
24+
rules:
25+
- allow: { method: GET, path: "/**" }
26+
- host: deb.debian.org
27+
port: 443
28+
protocol: rest
29+
enforcement: enforce
30+
tls: terminate
31+
rules:
32+
- allow: { method: GET, path: "/**" }

‎nemoclaw-blueprint/policies/presets/cargo.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
preset:
5+
name: cargo
6+
description: "Rust Cargo registry access"
7+
8+
network_policies:
9+
cargo_registry:
10+
name: cargo_registry
11+
endpoints:
12+
- host: crates.io
13+
port: 443
14+
protocol: rest
15+
enforcement: enforce
16+
tls: terminate
17+
rules:
18+
- allow: { method: GET, path: "/**" }
19+
- host: static.crates.io
20+
port: 443
21+
protocol: rest
22+
enforcement: enforce
23+
tls: terminate
24+
rules:
25+
- allow: { method: GET, path: "/**" }
26+
- host: index.crates.io
27+
port: 443
28+
protocol: rest
29+
enforcement: enforce
30+
tls: terminate
31+
rules:
32+
- allow: { method: GET, path: "/**" }

‎nemoclaw-blueprint/policies/presets/ghcr.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
preset:
5+
name: ghcr
6+
description: "GitHub Container Registry access"
7+
8+
network_policies:
9+
ghcr_registry:
10+
name: ghcr_registry
11+
endpoints:
12+
- host: ghcr.io
13+
port: 443
14+
protocol: rest
15+
enforcement: enforce
16+
tls: terminate
17+
rules:
18+
- allow: { method: GET, path: "/**" }
19+
- allow: { method: POST, path: "/**" }

‎nemoclaw-blueprint/policies/presets/go.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
preset:
5+
name: go
6+
description: "Go module proxy and checksum database"
7+
8+
network_policies:
9+
go_proxy:
10+
name: go_proxy
11+
endpoints:
12+
- host: proxy.golang.org
13+
port: 443
14+
protocol: rest
15+
enforcement: enforce
16+
tls: terminate
17+
rules:
18+
- allow: { method: GET, path: "/**" }
19+
- host: sum.golang.org
20+
port: 443
21+
protocol: rest
22+
enforcement: enforce
23+
tls: terminate
24+
rules:
25+
- allow: { method: GET, path: "/**" }
26+
- host: storage.googleapis.com
27+
port: 443
28+
protocol: rest
29+
enforcement: enforce
30+
tls: terminate
31+
rules:
32+
- allow: { method: GET, path: "/**" }

‎test/policies.test.js‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ const policies = require("../bin/lib/policies");
99

1010
describe("policies", () => {
1111
describe("listPresets", () => {
12-
it("returns all 9 presets", () => {
12+
it("returns all 13 presets", () => {
1313
const presets = policies.listPresets();
14-
assert.equal(presets.length, 9);
14+
assert.equal(presets.length, 13);
1515
});
1616

1717
it("each preset has name and description", () => {
@@ -23,7 +23,7 @@ describe("policies", () => {
2323

2424
it("returns expected preset names", () => {
2525
const names = policies.listPresets().map((p) => p.name).sort();
26-
const expected = ["discord", "docker", "huggingface", "jira", "npm", "outlook", "pypi", "slack", "telegram"];
26+
const expected = ["apt", "cargo", "discord", "docker", "ghcr", "go", "huggingface", "jira", "npm", "outlook", "pypi", "slack", "telegram"];
2727
assert.deepEqual(names, expected);
2828
});
2929
});
@@ -115,4 +115,36 @@ describe("policies", () => {
115115
}
116116
});
117117
});
118+
119+
describe("new preset endpoints", () => {
120+
it("cargo preset has crates.io endpoints", () => {
121+
const content = policies.loadPreset("cargo");
122+
const hosts = policies.getPresetEndpoints(content);
123+
assert.ok(hosts.includes("crates.io"));
124+
assert.ok(hosts.includes("static.crates.io"));
125+
assert.ok(hosts.includes("index.crates.io"));
126+
});
127+
128+
it("go preset has proxy and sum endpoints", () => {
129+
const content = policies.loadPreset("go");
130+
const hosts = policies.getPresetEndpoints(content);
131+
assert.ok(hosts.includes("proxy.golang.org"));
132+
assert.ok(hosts.includes("sum.golang.org"));
133+
assert.ok(hosts.includes("storage.googleapis.com"));
134+
});
135+
136+
it("apt preset has ubuntu and debian endpoints", () => {
137+
const content = policies.loadPreset("apt");
138+
const hosts = policies.getPresetEndpoints(content);
139+
assert.ok(hosts.includes("archive.ubuntu.com"));
140+
assert.ok(hosts.includes("security.ubuntu.com"));
141+
assert.ok(hosts.includes("deb.debian.org"));
142+
});
143+
144+
it("ghcr preset has registry and token endpoints", () => {
145+
const content = policies.loadPreset("ghcr");
146+
const hosts = policies.getPresetEndpoints(content);
147+
assert.ok(hosts.includes("ghcr.io"));
148+
});
149+
});
118150
});

0 commit comments

Comments
 (0)