kurogeek
08b5496980
Vendored from debling/nix-penpot (MIT). Fixes on top: - pnpm fetchers: drop --config.fetch-* flags (UND_ERR_INVALID_ARG on pnpm 11.27) and pin real store hashes (frontend x3, exporter, mcp) - deps-lock.json: add transitive funcool/beicon2 v2.0 so fake-git resolves potok2's pin during the shadow-cljs classpath build - expose frontend pnpm stores via passthru for rehashing - x86_64-linux only; devShell ships afk, jj, git
12 lines
407 B
Nix
12 lines
407 B
Nix
# Hardened ImageMagick policy shipped by the upstream images (resource caps
|
|
# and PS/EPS/PDF/XPS coders disabled); nixpkgs' default policy is
|
|
# unrestricted and the backend/exporter process user-controlled content.
|
|
{
|
|
runCommand,
|
|
penpot,
|
|
}:
|
|
runCommand "penpot-imagemagick-policy" { } ''
|
|
install -Dm644 "${penpot}/docker/images/files/imagemagick-policy.xml" \
|
|
"$out/etc/ImageMagick-7/policy.xml"
|
|
''
|