+
    $tjC	                         R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHt R R ltR R lt	]! R4      3R R	 llt
RR
 R llt]R8X  d   ]! ]! 4       4      hR# )zJResolve the sandbox egress allowlist to systemd IPAddressAllow properties.N)Pathc                F    V ^8  d   QhR\         R\        \        ,          /# )   configreturnr   liststr)formats   "f/home/user/overdeck-private-tests/workstation-ai-broad-final/modules/sandbox/host/lib/egress-policy.py__annotate__r      s      t S	     c                 |   \         P                  ! V P                  R R7      4      pVP                  R4      pVP                  R4      ^8w  g   \	        V\
        4      '       d	   V'       g   \        R4      h\        ;QJ d    R V 4       F  '       d   K   RM	  RM! R V 4       4      '       g   \        R4      hV# )	utf-8encodinghostsschema_versionzEegress allowlist must be schema_version 1 with a non-empty hosts listc              3   V   "   T F  p\        V\        4      ;'       d    Tx  K!  	  R # 5iN)
isinstancer	   ).0hosts   & r   	<genexpr>load_hosts.<locals>.<genexpr>   s"     @%$z$$---%s   ))FTz)egress allowlist contains an invalid host)jsonloads	read_textgetr   r   
ValueErrorall)r   payloadr   s   &  r   
load_hostsr"      s    jj))7);<GKK E{{#$)E41H1HPU`aa3@%@333@%@@@DEELr   c                \    V ^8  d   QhR\         \        ,          R\         \        ,          /# )r   r   r   )r   r	   )r
   s   "r   r   r      s&     ] ]c ]tCy ]r   c           
         \        4       pV  F2  p VP                  \        \        P                  ! V4      4      4       K4  	  \        VR R7      #   \
         d     Mi ; i\        P                  ! TR \        P                  R7      pT Uu0 uF0  p\        \        P                  ! T^,          ^ ,          4      4      kK2  	  Mu upi ppT'       g   \        T R24      hTP                  T4       K  )N)typez resolved to no addressesc                 F    \         P                  ! V 4      P                  V 3# r   )	ipaddress
ip_addressversion)values   &r   <lambda>resolve_hosts.<locals>.<lambda>#   s    	0D0DU0K0S0SUZ/[r   )key)setaddr	   r'   r(   r   socketgetaddrinfoSOCK_STREAMOSErrorupdatesorted)r   	addressesr   resultsitemresolveds   &     r   resolve_hostsr:      s    %I	MM#i22489:  )![\\  		$$T4f6H6HIFMNgdC	,,T!WQZ89gNNTF";<=="s   .AAA6Cz/etc/resolv.confc                F    V ^8  d   QhR\         R\        \        ,          /# )r   pathr   r   )r
   s   "r   r   r   &   s      T c r   c                 z   . pV P                  R R7      P                  4        F  pVP                  4       p\        V4      ^8  g   K%  V^ ,          R8X  g   K5  VP	                  \        \        P                  ! V^,          P                  R^4      ^ ,          4      4      4       K  	  V'       g   \        R4      hV# )r   r   
nameserver%zno DNS resolver addresses found)	r   
splitlinessplitlenappendr	   r'   r(   r   )r<   r6   linefieldss   &   r   resolver_addressesrF   &   s    I0;;=v;!q	\ 9S!5!5fQiooc16Ma6P!QRS > :;;r   c                T    V ^8  d   QhR\         \        ,          R,          R\        /# )r   argvNr   )r   r	   int)r
   s   "r   r   r   1   s#      tCy4 3 r   c                    \         P                  ! 4       pVP                  R R\        R7       VP                  RR. R7       VP	                  V 4      p . \        VP                  4      OVP                  O\        4       Op\        V4       F  p\        V4       K  	  ^ #   \        \        \        P                  3 d*   p\        RT 2\        P                   R7        Rp?^# Rp?ii ; i)	z--configT)requiredr%   z--hostrC   )actiondefaultz-egress-policy: refusing unrestricted launch: )fileN)argparseArgumentParseradd_argumentr   
parse_argsr"   r   r   rF   r:   printr3   r   r   JSONDecodeErrorsysstderr)rH   parserargsr   addressexcs   &     r   mainr[   1   s    $$&F

T=
2>T"DM*T[[)MDIIM8J8LM$U+G'N ,
  Z!5!56 =cUC#**Us   A
B    C) C$$C)__main__r   )__doc__rO   r'   r   r0   rU   pathlibr   r"   r:   rF   r[   __name__
SystemExit r   r   <module>rb      sV    P     
 ]  %));$<  z
TV
 r   