4 commits

Author	SHA1	Message	Date
eldritch horrors	097acae35b	tests/nixos: Test remote build against older versions ... (cherry picked from commit e502d1cf945fb3cdd0ca1e1c16ec330ccab51c7b) Change-Id: If6a1758b6457c5dae9305829c4d71d1905cfca22	2024-03-06 21:32:47 -07:00
eldritch horrors	706f0df55b	Merge pull request #9280 from R-VdP/rvdp/fix_remote_logging_phase_reporting ... Include phase reporting in log file for ssh-ng builds (cherry picked from commit b1e7d7cad625095656fff05ac4aedeb12135110a) Change-Id: I4076669b0ba160412f7c628ca9113f9abbc8c303	2024-03-06 19:11:12 -07:00
puck	6f36a8834c	Copy the output of fixed-output derivations before registering them ... It is possible to exfiltrate a file descriptor out of the build sandbox of FODs, and use it to modify the store path after it has been registered. To avoid that issue, don't register the output of the build, but a copy of it (that will be free of any leaked file descriptor). Test that we can't leverage abstract unix domain sockets to leak file descriptors out of the sandbox and modify the path after it has been registered. (cherry picked from commit 2dadfeb690e7f4b8f97298e29791d202fdba5ca6) (tests cherry picked from commit c854ae5b3078ac5d99fa75fe148005044809e18c) Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io> Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io> Co-authored-by: Tom Bereknyei <tomberek@gmail.com> Change-Id: I87cd58f1c0a4f7b7a610d354206b33301e47b1a4	2024-03-07 01:44:58 +00:00
eldritch horrors	2e1f5e2666	Merge pull request #9105 from Ericson2314/split-out-nixos-tests ... Define NixOS tests in `tests/nixos/default.nix` rather than `flake.nix` (cherry picked from commit c29b8ba142a0650d1182ca838ddc1b2d273dcd2a) Change-Id: Ieae1b6476d95024485df7067e008013bc5542039	2024-03-05 21:11:59 +01:00