# wget: the "write" policy, with any host, your wgetrc, its HSTS database
# and ~/Downloads. It saves files in the project or ~/Downloads, and
# nowhere else, so a download cannot replace anything that runs outside
# the sandbox later. ~/.netrc, which may hold passwords, is never
# readable. policies/commands/wget.policy in blinker's config directory
# comes first.

# type  access  pattern
include write
file    read    ${WGETRC:-~/.wgetrc}
file    write   ~/.wget-hsts
file    write   ~/Downloads

host    allow   *

env     allow   WGETRC
env     allow   SSL_CERT_FILE
env     allow   SSL_CERT_DIR