Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport #11610 to 2.20 maintenance (backport #11686) #11765

Closed
wants to merge 3 commits into from
Closed

Backport #11610 to 2.20 maintenance (backport #11686) #11765

wants to merge 3 commits into from

Commits on Oct 29, 2024

  1. fix passing CA files into builtins:fetchurl sandbox 

    This patch has been manually adapted from
lix-project/lix@14dc84e

Tested with:

$ NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'...
error:
       … writing file '/nix/store/0zynn4n8yx59bczy1mgh1lq2rnprvvrc-google.com'

       error: unable to download 'https://google.com': Problem with the SSL CA cert (path? access rights?) (77)
error: builder for '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv' failed with exit code 1

Now returns:

nix-env % NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
this derivation will be built:
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'...
error: hash mismatch in fixed-output derivation '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv':
         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
            got:    sha256-5xXEhGtnRdopaUTqaz2M1o2NE7ovhU0SjcSOPwntqwY=

(cherry picked from commit 1fbdf40)
(cherry picked from commit 9b818f1)

# Conflicts:
#	src/libstore/build/local-derivation-goal.cc
#	src/libstore/builtins/fetchurl.cc
    @puckipedia @mergify
    puckipedia authored and mergify[bot] committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    e393ee3 View commit details
    Browse the repository at this point in the history

  2. Fix the access of symlinks to host files in the sandbox 

    #10456 fixed the addition of symlink
store paths to the sandbox, but also made it so that the hardcoded
sandbox paths (like `/etc/hosts`) were now bind-mounted without
following the possible symlinks. This made these files unreadable if
there were symlinks (because the sandbox would now contain a symlink to
an unreachable file rather than the underlying file).
In particular, this broke FOD derivations on NixOS as `/etc/hosts` is a
symlink there.

Fix that by canonicalizing all these hardcoded sandbox paths before
adding them to the sandbox.

(cherry picked from commit acbb152)
(cherry picked from commit 1cc79f1)

# Conflicts:
#	tests/functional/linux-sandbox.sh
    @mergify
    Théophane Hufschmitt authored and mergify[bot] committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    90e8476 View commit details
    Browse the repository at this point in the history

  3. Test the inclusion of transitive symlinks in the sandbox 

    (cherry picked from commit cef677d)
(cherry picked from commit e8e62c9)

# Conflicts:
#	tests/functional/linux-sandbox.sh
    @mergify
    Théophane Hufschmitt authored and mergify[bot] committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    b6f329c View commit details
    Browse the repository at this point in the history