mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-31 12:44:44 +00:00
0e7826fd7a
Switch to fetching only certdata.txt directly from the upstream repository (and a mirror), because: - While it's possible to deduct that github/nss-dev is an NSS-project-owned mirror repository, it's not trivial: - Go to the homepage: https://firefox-source-docs.mozilla.org/security/nss/index.html - Navigate to the source, e.g. https://phabricator.services.mozilla.com/source/nss/ - Check the readme.md, which mentions github.com/nss-dev/nss - GitHub is a mirror of the Mercurial repository, and while I was able to confirm that the latest version does match, it leaves more room for a malicious actor: - It's unknown who owns the nss-dev GitHub organisation, there's no public members and no contact information - The mirroring automation from Mercurial to GitHub is not documented - Git hashes by necessity don't match Mercurial hashes, so it's not easy to verify that they match - Previously the build and update script were more complicated and slow by depending on the entire source, when we really only need a single file. Furthermore, update the meta.homepage to point to the actual page that mentions the root certificates, because the old one pointed to a curl page which we don't even use anymore (if we ever even did, Git history is inconclusive) The cacert build was verified to be unchanged
40 lines
1.7 KiB
Bash
Executable File
40 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env nix-shell
|
|
#!nix-shell -i bash -p nix common-updater-scripts jq
|
|
|
|
# Build both the cacert package and an overridden version where we use the source attribute of NSS.
|
|
# Cacert and NSS are both from the same upstream sources. They are decoupled as
|
|
# the cacert output only cares about a few infrequently changing files in the
|
|
# sources while the NSS source code changes frequently.
|
|
#
|
|
# By having cacert on a older source revision that produces the same
|
|
# certificate output as a newer version we can avoid large amounts of
|
|
# unnecessary rebuilds.
|
|
#
|
|
# As of this writing there are a few magnitudes more packages depending on
|
|
# cacert than on nss.
|
|
#
|
|
# We use `nss_latest` instead of `nss_esr`, because that is the newer version
|
|
# and we want up-to-date certificates.
|
|
# `nss_esr` is used for the ecosystem at large through the `nss` attribute,
|
|
# because it is updated less frequently and maintained for longer, whereas `nss_latest`
|
|
# is used for software that actually needs a new nss, e.g. Firefox.
|
|
|
|
set -ex
|
|
|
|
BASEDIR="$(dirname "$0")/../../../.."
|
|
|
|
|
|
CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
|
|
PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs { src = nss_latest.src + \"/lib/ckfw/builtins/certdata.txt\"; }).out")
|
|
|
|
# Check the hash of the etc subfolder
|
|
# We can't check the entire output as that contains the nix-support folder
|
|
# which contains the output path itself.
|
|
CURRENT_HASH=$(nix-hash "$CURRENT_PATH/etc")
|
|
PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
|
|
|
|
if [[ "$CURRENT_HASH" != "$PATCHED_HASH" ]]; then
|
|
NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss_latest.version" | jq -r .)
|
|
update-source-version cacert "$NSS_VERSION"
|
|
fi
|