fetch() allows HTTPS by default. Network policy can be tightened or extended
with global flags or their configuration equivalents. Fetch policy has a trust
boundary that differs from ordinary configuration precedence: system and user
configuration, NETSUKE_ environment variables, and explicit CLI options are
operator policy, while every occurrence in the selected project configuration
chain is an untrusted project request.
--fetch-allow-scheme <SCHEME>--fetch-allow-host <HOST>--fetch-block-host <HOST>--fetch-default-deny--trust-project-fetch-policy
By default, the project chain may only narrow the operator policy. A project
fetch_default_deny = true can enable default-deny, but a project
fetch_default_deny = false cannot disable an operator's default-deny setting.
Project fetch_block_host entries accumulate with entries from the other
layers, and a block always wins over an allow. Project-chain
fetch_allow_scheme and fetch_allow_host entries are ignored by default; no
project-chain file can enable them by setting trust_project_fetch_policy
itself.
For example, if .netsuke.toml extends policy.toml, grants in either file
are project-chain requests and need operator opt-in before they can widen the
fetch policy. A trust_project_fetch_policy = true in policy.toml is also
quarantined and cannot authorize those grants; trust must come from system,
user, environment, or CLI configuration.
An operator who deliberately trusts a checkout can set
trust_project_fetch_policy = true in system or user configuration, set
NETSUKE_TRUST_PROJECT_FETCH_POLICY=true, or pass
--trust-project-fetch-policy. With that opt-in, project allow-scheme and
allow-host entries are appended to the operator values in dependency-first
order, with the primary file last. A present fetch_default_deny value from
the project chain applies directly; the last present project value wins. The
opt-in is resolved only from operator-controlled layers, so no project-chain
file can self-authorize. When a file is reached from both operator and project
roots, each occurrence retains its own authority.
Host patterns may contain wildcards such as *.example.com. A block rule wins
over an allow rule. --fetch-default-deny permits only explicitly allowed
hosts.