From b0e1a5aa3537a9fc107a3a25003e752b4549b153 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Date: Mon, 31 Aug 2026 14:16:22 +0200 Subject: [PATCH] feat(devel): allow buf.build egress in the sandbox kit The Buf Schema Registry is required by `make api` / `buf generate` to resolve the buf.yaml module dependencies and the remote plugins declared in the buf.gen.yaml files. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Chainloop-Trace-Sessions: c38cbc47-25fd-4071-a3f4-ed5fbfc06ef2 --- devel/sandbox-kit/spec.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/devel/sandbox-kit/spec.yaml b/devel/sandbox-kit/spec.yaml index f9d148ff3..7521bf26c 100644 --- a/devel/sandbox-kit/spec.yaml +++ b/devel/sandbox-kit/spec.yaml @@ -368,6 +368,9 @@ permissions: # v1: `network.allowedDomains:` - "timestamp.digicert.com:80" # RFC 3161 timestamp authority (plain HTTP, signed response) # used during attestation signing; host comes from the # control plane's signing options + - "buf.build:443" # Buf Schema Registry - `make api` / `buf generate` + # resolve the buf.yaml module deps and the remote + # plugins declared in the buf.gen.yaml files - "dl.chainloop.dev:443" # EE CLI installer - "chainloop-baafegchfnekdcde.z02.azurefd.net:443" # EE CLI download CDN - "github.com:443" # git push over HTTPS in persistent mode - the