//! Asserts that native build scripts cannot access host files or the network.
use std::{
    env, fs,
    net::{SocketAddr, TcpStream},
    time::Duration,
};

fn main() {
    let home = env::var("HOME").unwrap();
    assert!(fs::read_dir(format!("{home}/.ssh")).is_err());
    assert!(fs::read_dir("/home/surma/.ssh").is_err());
    assert!(fs::write("/outside-target-probe", "escape").is_err());
    let address: SocketAddr = "1.1.1.1:443".parse().unwrap();
    assert!(TcpStream::connect_timeout(&address, Duration::from_secs(1)).is_err());
    println!("cargo:warning=PASS: HOME/.ssh hidden, outside write denied, network denied");
    println!("cargo:rerun-if-changed=build.rs");
}