fix: harden runtime config lease boundary

This commit is contained in:
2026-08-11 12:43:14 +02:00
parent cf88e2df86
commit ec92f7f994
8 changed files with 324 additions and 149 deletions
+5 -4
View File
@@ -638,10 +638,11 @@ def _strict_runtime_manifest(raw: object) -> dict[str, object]:
def _canonical_runtime_path(path: Path) -> Path:
value = str(path)
if value == "/tmp" or value.startswith("/tmp/"):
return Path("/private" + value)
if value == "/var" or value.startswith("/var/"):
return Path("/private" + value)
if sys.platform == "darwin":
if value == "/tmp" or value.startswith("/tmp/"):
return Path("/private" + value)
if value == "/var" or value.startswith("/var/"):
return Path("/private" + value)
return path