warnIf sends our warning message through a function call, even if the
warning condition doesn't trigger. This requires a lot of thunk
allocation that can be easily avoided.
Allows having alternate hashed mirrors as fallbacks. Useful in case the
default hashed mirror is not accessible or doesn't have everything
needed.
Co-authored-by: Johan Herland <johan.herland@tweag.io>
Co-authored-by: Yuriy Taraday <yuriy.taraday@tweag.io>
Co-authored-by: Alexander Bantyev <balsoft@balsoft.ru>
Thanks to @emilazy for the report:
https://github.com/NixOS/nixpkgs/pull/393136#issuecomment-3268711663
Fixes this crash:
```
… from call site
at /Users/emily/Developer/nixpkgs/pkgs/build-support/fetchurl/default.nix:194:70:
193| else
194| throw "fetchurl requires a hash for fixed-output derivation: ${lib.generators.toPretty urls_}";
| ^
195|
… while evaluating the value passed for the lambda argument
at /Users/emily/Developer/nixpkgs/lib/generators.nix:524:5:
523| toPretty =
524| {
| ^
525| allowPrettyValues ? false,
error: expected a set but found a list: [ "https://cmake.org/files/v4.1/cmake-4.1.1.tar.gz" ]
```
It'll still crash, but with a nicer error message!
Without the change `resolvedUrl` fails on non-mirror:// packages as:
$ nix eval --impure --expr 'with import ./. {}; AMB-plugins.src.resolvedUrl'
error:
...
error: expected a list but found null: null
After ther change the eval works as expected:
$ nix eval --impure --expr 'with import ./. {}; AMB-plugins.src.resolvedUrl'
"http://kokkinizita.linuxaudio.org/linuxaudio/downloads/AMB-plugins-0.8.1.tar.bz2"
This allows on-the-fly rewriting of URLs before they are passed from
fetchurl (or fetchurlBoot) to curl.
The intended use is to allow inserting company-internal mirrors, or
working around company firewalls and similar network restrictions,
without having to extensively patch across all of nixpkgs. Instead,
users can pass a function in their nixpkgs that performs the necessary
URL rewrites.
Co-authored-by: Alexander Bantyev <balsoft@balsoft.ru>
Right now, when building any FOD that uses `fetchurl` (which is the
majority of ours), `tarballs.nixos.org` will always be contacted
before the actual URL. Given that `tarballs.nixos.org` mainly hosts
the bootstrap tools, which already explicitly set it as the host to pull
from, it doesn't make much sense to force every other `fetchurl`
invocation to first reach out to `tarballs.nixos.org`.
I recently saw this error message, which required I use the `--debugger`
to locate:
```
error:
… while evaluating an expression to select 'drvPath' on it
at «internal»:1:552:
… while calling the 'derivationStrict' builtin
at «internal»:1:208:
(stack trace truncated; use '--show-trace' to show the full trace)
error: multiple hashes passed to fetchurl
```
This patch improves the error message, and other error messages from
`fetchurl`:
```
error:
… while evaluating an expression to select 'drvPath' on it
at «internal»:1:552:
… while calling the 'derivationStrict' builtin
at «internal»:1:208:
(stack trace truncated; use '--show-trace' to show the full trace)
error: multiple hashes passed to fetchurl: [
"https://github.com/reorg/pg_repack/archive/refs/tags/ver_1.5.0.tar.gz"
]
```
This is a follow-up to a169553f7e.
In most cases it should allow the TLS verification to be enabled.
It also makes the behavior of `fetchurl` more consistent with other fetchers
like `fetchgit`.
Ideally we would always fallback on `cacert` but I am not sure how to build
`cacert` during bootstrap without making an unmaintainable mess.
This make sure the credentials cannot be leaked in a MITM attack.
Note that this change might break some existing deployments if the users
tries to fetch resources on endpoints with invalid certificates.
The impacted users will have the following choices:
* fix the endpoint providing the resource
* override SSL_CERT_FILE to either disable the verification (not
recommended) or to set it to a path including their CA certificate.
