# go: the "write" policy, with the Go module proxy and checksum
# database, and Go's caches. Tests and programs run here, which is the
# point: they reach nothing but the proxy. The caches are writable: a
# module that is not yours can put things there, toolchains included,
# that later builds outside the sandbox use. policies/commands/go.policy in
# blinker's config directory comes first.

# type  access  pattern
include write
file    write   ${XDG_CONFIG_HOME:-~/.config}/go
file    read    ${GOPATH:-~/go}
file    write   ${GOPATH:-~/go}/pkg/
file    write   ${GOMODCACHE:-${GOPATH:-~/go}/pkg/mod}/
file    write   ${GOCACHE:-${XDG_CACHE_HOME:-~/.cache}/go-build}/

host    allow   proxy.golang.org
host    allow   sum.golang.org

env     allow   GOPATH
env     allow   GOMODCACHE
env     allow   GOCACHE
env     allow   GOROOT
env     allow   GOFLAGS
env     allow   GOPROXY
env     allow   GOPRIVATE
env     allow   GONOSUMDB
env     allow   GOTOOLCHAIN
env     allow   CGO_*
env     allow   CC
env     allow   CXX