sandboxec v0.3.0

Changelog

• 6a62356 feat: add named-config option (#3)
  • Adds -C, --named-config to load a profile from the sandboxec/profiles repository (resolved to raw YAML on the based branch).
  • Enables running with shared profiles without a local config file, e.g. sandboxec --named-config agents/claude -- claude.
  • --config and --named-config are mutually exclusive; using both now returns an explicit error.
  • Named values are normalized (/prefix and .yaml/.yml suffixes are handled); empty values fail fast.

Verify

Important

It is strongly recommended to verify the integrity and security of the release assets before executing them. This helps mitigate potential risks associated with running unverified files.

First, verify the file using checksums.

sha256sum --check --ignore-missing sandboxec_v0.3.0-checksums.txt

Then, ensure the authenticity of the release asset with Sigsum:

Note

You need to have sigsum-verify CLI installed.

go install sigsum.org/sigsum-go/cmd/sigsum-verify@v0.13.1

sigsum-verify -k sandboxec-sigsum-key.pub -p sigsum-trust-policy.txt \
  sandboxec_v0.3.0-OS_ARCH.proof < sandboxec_v0.3.0-OS_ARCH