Support restricted mode: Allow manifest access with search paths.

[pinch] / pinch.py

diff --git a/pinch.py b/pinch.py
index 2ba47b22db129d06fe4d88851f5d19346cbc7d11..f95323f68edc611ead3c3e85de9ec814dc785e09 100644 (file)
--- a/pinch.py
+++ b/pinch.py
@@ -644,7 +644,11 @@ def pinCommand(args: argparse.Namespace) -> None:
 def updateCommand(args: argparse.Namespace) -> None:
     v = Verification()
     exprs: Dict[str, str] = {}
-    search_paths: List[str] = []
+    profile_manifest = os.path.join(args.profile, "manifest.nix")
+    search_paths: List[str] = [
+        "-I", "pinch_profile=" + args.profile,
+        "-I", "pinch_profile_manifest=" + os.readlink(profile_manifest)
+    ] if os.path.exists(profile_manifest) else []
     config = {
         section: read_pinned_config_section(section, conf) for section,
         conf in read_config_files(