[Nix#10139] nix lock can modify lock files in the nix store and corrupt it #47

New issue

Open

opened 2024-03-16 06:32:18 +00:00 by lix-bot · 1 comment

lix-bot commented

2024-03-16 06:32:18 +00:00

Member

Upstream-Issue: NixOS/nix#10139

Describe the bug

Using --update-input can allow nix to modify the lockfile in the nix store, rendering it corrupted

Steps To Reproduce


$ export NIX_CONFIG="experimental-features = nix-command flakes"

$ nix flake info "git+https://gist.github.com/8f6fae8f7406d2bb5edd636cdcd47d37.git"
[...]
Path:          /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source
[...]

$ md5sum /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock 
01f01a46a97b7e78de94cce4ebfeb989  /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock

$ nix flake lock --update-input nixpkgs /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source
warning: '--update-input' is a deprecated alias for 'flake update' and will be removed in a future version.
warning: updating lock file '/nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock':
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/1d1817869c47682a6bee85b5b0a6537b6c0fba26' (2024-02-16)
  → 'github:NixOS/nixpkgs/79baff8812a0d68e24a836df0a364c678089e2c7' (2024-03-01)

$ md5sum /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock 
095a3e64f215ba303a071ac0284816f9  /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock

$ nix store verify /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source 
path '/nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source' was modified! expected hash 'sha256:0f8v47bpn5cdfvsah14ar2wljz72bprcm224g7jydqm1l8sfa5ca', got 'sha256:0lxi4zmykn5nnsdp8aa9p7q1jav8vvn34axbjgw089xp0jilflld'

Expected behavior

The store should not be modified (there should be an error, or --no-write-lock-file should be implied)

nix-env --version output
nix-env (Nix) 2.20.4

Additional context

This was discovered by following the wiki guide here:
https://nixos.wiki/wiki/Automatic_system_upgrades

With this configuration, the auto update script will run commands such as:

/nix/store/xnw2dyxxbasc6rxm7n4fq0fga2iiy1dn-nixos-rebuild/bin/nixos-rebuild switch --update-input nixpkgs -L --flake /nix/store/mis15fq6fbvv3r3pqrydk9qpxqvrn186-source --upgrade

Upstream-Issue: https://git.lix.systems/NixOS/nix/issues/10139 **Describe the bug** Using `--update-input` can allow nix to modify the lockfile in the nix store, rendering it corrupted **Steps To Reproduce** ```bash $ export NIX_CONFIG="experimental-features = nix-command flakes" $ nix flake info "git+https://gist.github.com/8f6fae8f7406d2bb5edd636cdcd47d37.git" [...] Path: /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source [...] $ md5sum /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock 01f01a46a97b7e78de94cce4ebfeb989 /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock $ nix flake lock --update-input nixpkgs /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source warning: '--update-input' is a deprecated alias for 'flake update' and will be removed in a future version. warning: updating lock file '/nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock': • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/1d1817869c47682a6bee85b5b0a6537b6c0fba26' (2024-02-16) → 'github:NixOS/nixpkgs/79baff8812a0d68e24a836df0a364c678089e2c7' (2024-03-01) $ md5sum /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock 095a3e64f215ba303a071ac0284816f9 /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source/flake.lock $ nix store verify /nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source path '/nix/store/ym20x8nwxyg574s4159947sbrn5a2ilr-source' was modified! expected hash 'sha256:0f8v47bpn5cdfvsah14ar2wljz72bprcm224g7jydqm1l8sfa5ca', got 'sha256:0lxi4zmykn5nnsdp8aa9p7q1jav8vvn34axbjgw089xp0jilflld' ``` **Expected behavior** The store should not be modified (there should be an error, or `--no-write-lock-file` should be implied) **`nix-env --version` output** nix-env (Nix) 2.20.4 **Additional context** This was discovered by following the wiki guide here: https://nixos.wiki/wiki/Automatic_system_upgrades With this configuration, the auto update script will run commands such as: ``` /nix/store/xnw2dyxxbasc6rxm7n4fq0fga2iiy1dn-nixos-rebuild/bin/nixos-rebuild switch --update-input nixpkgs -L --flake /nix/store/mis15fq6fbvv3r3pqrydk9qpxqvrn186-source --upgrade ```