iceweasel-oai d9960e12bb Add a bubblewrap backend for sandbox integrity checks (#51840) ...

## What changed

Add Linux dependency discovery and policy preparation to `exec-server`'s sandbox integrity module. Inventory bundled and system `bwrap` candidates and the deny-glob scanner using the launcher's location and the command's `PATH` and working directory.

Resolve `:tmpdir` and tilde-prefixed deny globs using the command's `TMPDIR` and `HOME`, with account home-directory fallback. Reuse Linux sandbox helpers to expand deny globs in the command's explicit environment.

## Testing

Add Linux tests covering symlinked launchers, relative and empty `PATH` entries, and empty, relative, and tilde-prefixed `TMPDIR` values alongside home-relative deny globs.

GitOrigin-RevId: fe404fa4be77ece677b22d52d77a7234dbf0cffe

2026-10-07 21:50:48 +00:00

..

src

Add a bubblewrap backend for sandbox integrity checks (#51840)

2026-10-07 21:50:48 +00:00

BUILD.bazel

Add a fail-closed Tree-sitter PowerShell lowerer (#39213)

2026-08-18 14:59:43 +00:00

Cargo.toml

Move shell snapshot tests into shell-command (#39480)

2026-08-19 12:56:08 +00:00