hosts/common: ship libgpiod

hosts/common/programs/assorted.nix

@@ -73,6 +73,7 @@ in
       "less"
       "lftp"
       "libcap_ng"  # for `netcap`, `pscap`, `captest`
+      "libgpiod"  # `gpiodetect`, `gpioinfo`, `gpiomon`, ...
       "lsof"
       "man-pages"
       "man-pages-posix"
@@ -686,14 +687,6 @@ in
       ".local/share/tessdata"  # 15M; dunno what all it is.
     ];
 
-    # hitori rules:
-    # - click to shade a tile
-    # 1. no number may appear unshaded more than once in the same row/column
-    # 2. no two shaded tiles can be direct N/S/E/W neighbors
-    # - win once (1) and (2) are satisfied
-    hitori.buildCost = 1;
-    hitori.sandbox.whitelistWayland = true;
-
     gnugrep.sandbox.autodetectCliPaths = "existing";
     gnugrep.sandbox.whitelistPwd = true;
     gnugrep.sandbox.extraHomePaths = [
@@ -726,6 +719,14 @@ in
     hdparm.sandbox.autodetectCliPaths = "existingFile";
     hdparm.sandbox.tryKeepUsers = true;
 
+    # hitori rules:
+    # - click to shade a tile
+    # 1. no number may appear unshaded more than once in the same row/column
+    # 2. no two shaded tiles can be direct N/S/E/W neighbors
+    # - win once (1) and (2) are satisfied
+    hitori.buildCost = 1;
+    hitori.sandbox.whitelistWayland = true;
+
     host.sandbox.net = "all";  #< technically, only needs to contact localhost's DNS server
 
     iftop.sandbox.net = "all";
@@ -775,6 +776,8 @@ in
 
     libcap_ng.sandbox.enable = false;  # TODO: `pscap` can sandbox with bwrap, `captest` and `netcap` with landlock
 
+    libgpiod.sandbox.method = null;  #< TODO: sandbox
+
     libnotify.sandbox.whitelistDbus = [ "user" ];  # notify-send
 
     lightning-cli.packageUnwrapped = pkgs.linkBinIntoOwnPackage pkgs.clightning "lightning-cli";