Reference

Security Model

Validated structure, quoted path substitutions, and an auditable network policy for the fetch() helper. A Netsukefile deserves the same care as a Makefile.

Network Policy

The fetch() standard-library function downloads content from URLs at template evaluation time. Because this happens before a build runs, Netsuke provides configurable network-policy controls so that teams can audit and restrict what remote resources a manifest is allowed to contact.

--fetch-allow-scheme <SCHEME>

Allow additional URL schemes beyond the defaults. Repeat the flag to allow multiple schemes.

--fetch-allow-host <HOST>

Allow the provided hostname when default-deny mode is active. Wildcards such as *.example.com are supported.

--fetch-block-host <HOST>

Always block the provided hostname, even if it appears on the allowlist. Wildcards are supported.

--fetch-default-deny

Deny all hosts by default. Only hosts explicitly allowed by --fetch-allow-host may be contacted.

Restricting fetch to a single host

$ netsuke \
  --fetch-default-deny \
  --fetch-allow-host releases.example.com \
  --fetch-block-host internal.example.com \
  build

Security Model

Safe by Default

Netsuke validates every manifest against a schema before template expansion runs, and escapes shell interpolation to prevent injection. Diagnostics are typed, so validation failures point to the exact manifest location rather than surfacing as opaque errors.

YAML first

The manifest must be valid YAML before any template expansion happens. Structural mistakes fail early, before commands are generated.

Shell escaping

Interpolated values in commands and scripts are escaped by default, with explicit opt-outs for raw usage where the author really means it.

Typed diagnostics

CLI errors are designed to carry context, hints, and localized output rather than dropping raw parser failures on the floor.

Vulnerability Mitigation

Qualitative comparison based on documented safety features; no numeric mitigation claim is implied.

Manifest schema validation, default shell escaping, and typed diagnostics give Netsuke stronger qualitative mitigation than ad hoc scripts on each documented boundary. Interactive charting requires JavaScript.

Configuration

Examples Hub