Support restricted mode: Allow manifest access with search paths.

diff --git a/Changelog b/Changelog
index de62e83a9b0c7ad3626859267b70951642ecdd12..a0932a9d12f60bb79311ae0b7a586ccd3ee2df9e 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -3,7 +3,7 @@
 - Deprecate pinch.
 - Show the channel URL being fetched.
 - Use nix 2.3 because 2.4 broke <nix/unpack-channel.nix>.
-- Support restricted mode: Allow tarball access with search paths.
+- Support restricted mode: Allow tarball and manifest access with search paths.
 - Announce test names as they are run.
 
 

diff --git a/pinch.py b/pinch.py
index 2ba47b22db129d06fe4d88851f5d19346cbc7d11..f95323f68edc611ead3c3e85de9ec814dc785e09 100644 (file)
--- a/pinch.py
+++ b/pinch.py
@@ -644,7 +644,11 @@ def pinCommand(args: argparse.Namespace) -> None:
 def updateCommand(args: argparse.Namespace) -> None:
     v = Verification()
     exprs: Dict[str, str] = {}
-    search_paths: List[str] = []
+    profile_manifest = os.path.join(args.profile, "manifest.nix")
+    search_paths: List[str] = [
+        "-I", "pinch_profile=" + args.profile,
+        "-I", "pinch_profile_manifest=" + os.readlink(profile_manifest)
+    ] if os.path.exists(profile_manifest) else []
     config = {
         section: read_pinned_config_section(section, conf) for section,
         conf in read_config_files(