Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport #11610 to 2.19 maintenance #11693

Open
wants to merge 6 commits into
base: 2.19-maintenance
Choose a base branch
from
Open

Backport #11610 to 2.19 maintenance #11693

wants to merge 6 commits into from

Commits on Oct 14, 2024

  1. fixup! Add a test for builtin:fetchurl cert verification

    @puckipedia @roberth
    puckipedia authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    bdc4e60 View commit details
    Browse the repository at this point in the history

  2. fix passing CA files into builtins:fetchurl sandbox 

    This patch has been manually adapted from
lix-project/lix@14dc84e

Tested with:

$ NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'...
error:
       … writing file '/nix/store/0zynn4n8yx59bczy1mgh1lq2rnprvvrc-google.com'

       error: unable to download 'https://google.com': Problem with the SSL CA cert (path? access rights?) (77)
error: builder for '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv' failed with exit code 1

Now returns:

nix-env % NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
this derivation will be built:
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'...
error: hash mismatch in fixed-output derivation '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv':
         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
            got:    sha256-5xXEhGtnRdopaUTqaz2M1o2NE7ovhU0SjcSOPwntqwY=

(cherry picked from commit 1fbdf40)
    @puckipedia @roberth
    puckipedia authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    b6b683b View commit details
    Browse the repository at this point in the history

  3. tests/nixos/fetchurl: drop unused variables 

    (cherry picked from commit de9946c)
    @Mic92 @roberth
    Mic92 authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    cf43b52 View commit details
    Browse the repository at this point in the history

  4. Fix the access of symlinks to host files in the sandbox 

    #10456 fixed the addition of symlink
store paths to the sandbox, but also made it so that the hardcoded
sandbox paths (like `/etc/hosts`) were now bind-mounted without
following the possible symlinks. This made these files unreadable if
there were symlinks (because the sandbox would now contain a symlink to
an unreachable file rather than the underlying file).
In particular, this broke FOD derivations on NixOS as `/etc/hosts` is a
symlink there.

Fix that by canonicalizing all these hardcoded sandbox paths before
adding them to the sandbox.

(cherry picked from commit acbb152)
    @roberth
    Théophane Hufschmitt authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    67d369a View commit details
    Browse the repository at this point in the history

  5. Test the inclusion of transitive symlinks in the sandbox 

    (cherry picked from commit cef677d)
    @roberth
    Théophane Hufschmitt authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    1047383 View commit details
    Browse the repository at this point in the history

  6. feat: better warning for common SSL errors 

    (cherry picked from commit 3e5bf90)
    @roberth
    Tom Bereknyei authored and roberth committed Oct 14, 2024
    Configuration menu
    Copy the full SHA
    9965a29 View commit details
    Browse the repository at this point in the history