From e946a55830249b9e8b133f0faf54e9d5ece542b1 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Trivino Date: Mon, 31 Aug 2026 19:01:42 +0200 Subject: [PATCH] feat(devel): allow download.chainloop.dev egress in the sandbox kit Add download.chainloop.dev to the traced sandbox kit's egress allowlist so the EE CLI binary download is not blocked by the deny-by-default network policy. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino Chainloop-Trace-Sessions: 0f5545f7-2d2a-42b6-ac77-2761b445a17a, ce7edc24-1767-49b5-b2ab-71fbefb0d4d2, e4e8a764-7ec9-4a9f-98ac-f8fe7c21b9f2 --- devel/sandbox-kit/spec.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/devel/sandbox-kit/spec.yaml b/devel/sandbox-kit/spec.yaml index 31b3ea842..b831b04f8 100644 --- a/devel/sandbox-kit/spec.yaml +++ b/devel/sandbox-kit/spec.yaml @@ -372,6 +372,7 @@ permissions: # v1: `network.allowedDomains:` # resolve the buf.yaml module deps and the remote # plugins declared in the buf.gen.yaml files - "dl.chainloop.dev:443" # EE CLI installer + - "download.chainloop.dev:443" # EE CLI binary downloads - "chainloop-baafegchfnekdcde.z02.azurefd.net:443" # EE CLI download CDN - "github.com:443" # git push over HTTPS in persistent mode - the # pre-push attestation egresses on push. Other