nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-22 08:30:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fetchurl: enable TLS verification when credentials are used

Browse Source 
This make sure the credentials cannot be leaked in a MITM attack.
Note that this change might break some existing deployments if the users
tries to fetch resources on endpoints with invalid certificates.
The impacted users will have the following choices:
* fix the endpoint providing the resource
* override SSL_CERT_FILE to either disable the verification (not
  recommended) or to set it to a path including their CA certificate.

(cherry picked from commit a169553f7e)
This commit is contained in:
Thomas Gerbet
2024-09-23 18:27:02 +02:00
committed by Alyssa Ross
parent 7faae2f631
commit 4fa7aadebd
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkgs/build-support/fetchurl/default.nix
View File

@@ -164,7 +164,8 @@ stdenvNoCC.mkDerivation ((
# New-style output content requirements.
inherit (hash_) outputHashAlgo outputHash;
SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash)
# Disable TLS verification only when we know the hash and no credentials are needed to access the ressource
SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash || netrcPhase != null)
then "${cacert}/etc/ssl/certs/ca-bundle.crt"
else "/no-cert-file.crt";