Large change to sandboxing:
- fixes a nasty TOCTOU relating to a symlink swap attack, documented in
the `sandboxing/README.md`
- Adds UI and restrictions when in an untrusted workspace
- Adds tests for (soon to be removed) git support
---
Release Notes:
- N/A or Added/Fixed/Improved ...
Release Notes:
Refactored:
- Use [flake-parts](https://flake.parts/index.html) modules
- `nix/shell.nix` -> `nix/modules/devshells.nix`
Added:
- Use
[flake-parts.partitions](https://flake.parts/options/flake-parts-partitions.html)
to isolate dev dependencies so that flakes that use `zed-editor` don't
fetch dev-only inputs such as `treefmt-nix`
- [treefmt-nix](https://github.com/numtide/treefmt-nix)
- nixfmt
- rustfmt
Fixed:
- `shell.nix` and `default.nix` fetching `flake-compat` from
`flake.lock` which added an extra and unnecessary input/dependency to
`flake.nix`. Fixed by setting a fixed rev and sha256 instead.
- `nixfmt-rfc-style` is deprecated and is now `nixfmt`
- Fixes#45338 by using rust-overlay toolchain directly
- Previously, the devShell included `rustup` which caused slow startup
times as Nix would build rustup from source (including running its test
suite). Additionally, rust tooling (cargo, rustfmt, clippy,
rust-analyzer) wasn't available in the dev shell.
- cargo, rustc, and rust-toolchain.toml components included in
`rustToolchain`
Chore:
- Update `flake.lock`
- Format Rust code with `rustfmt` via `treefmt-nix`
---------
Co-authored-by: Jakub Konka <kubkon@jakubkonka.com>
