dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fetchurl: enable TLS verification when NIX_SSL_CERT_FILE is set (#350222)

Browse Source
This commit is contained in:
Philip Taron 2024-10-23 14:07:17 -07:00 committed by GitHub
commit db44da13e1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkgs/build-support/fetchurl/builder.sh
View File

@ -19,7 +19,8 @@ curl=(
--user-agent "curl/$curlVersion Nixpkgs/$nixpkgsVersion"
)
if ! [ -f "$SSL_CERT_FILE" ]; then
# Default fallback value defined in pkgs/build-support/fetchurl/default.nix
if [ "$SSL_CERT_FILE" == "/no-cert-file.crt" ]; then
curl+=(--insecure)
fi

12
pkgs/build-support/fetchurl/default.nix
View File

@ -220,20 +220,26 @@ stdenvNoCC.mkDerivation (
# New-style output content requirements.
inherit (hash_) outputHashAlgo outputHash;
# Disable TLS verification only when we know the hash and no credentials are
# needed to access the resource
SSL_CERT_FILE =
if
let
nixSSLCertFile = builtins.getEnv "NIX_SSL_CERT_FILE";
in
if nixSSLCertFile != "" then
nixSSLCertFile
else if
(
hash_.outputHash == ""
|| hash_.outputHash == lib.fakeSha256
|| hash_.outputHash == lib.fakeSha512
|| hash_.outputHash == lib.fakeHash
# Make sure we always enforce TLS verification when credentials
# are needed to access the resource
|| netrcPhase != null
)
then
"${cacert}/etc/ssl/certs/ca-bundle.crt"
else
# Fallback to stdenv default, see pkgs/stdenv/generic/setup.sh
"/no-cert-file.crt";
outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";