nrabulinski/lix

Author SHA1 Message Date

Author	SHA1	Message	Date
Tom Bereknyei	6334e91b2f	feat: better warning for common SSL errors (cherry picked from commit 3e5bf903413f420c1f997e4b55140761172b8434) Upstream-PR: https://github.com/NixOS/nix/pull/11246 Change-Id: `Iccd92721bbcd92604a4b0e5c845242bdf3dd0f66`	2024-11-18 16:49:35 -08:00
Puck Meerburg	37b22dae04	Fix passing custom CA files into the builtin:fetchurl sandbox Without this, verifying TLS certificates would fail on macOS, as well as any system that doesn't have a certificate file at /etc/ssl/certs/ca-certificates.crt, which includes e.g. Fedora. Change-Id: `Iaa2e0e9db3747645b5482c82e3e0e4e8f229f5f9`	2024-09-26 15:25:28 +00:00
Eelco Dolstra	c1631b0a39	[security] builtin:fetchurl: Enable TLS verification This is better for privacy and to avoid leaking netrc credentials in a MITM attack, but also the assumption that we check the hash no longer holds in some cases (in particular for impure derivations). Partially reverts `5db358d4d7`. (cherry picked from commit c04bc17a5a0fdcb725a11ef6541f94730112e7b6) (cherry picked from commit f2f47fa725fc87bfb536de171a2ea81f2789c9fb) (cherry picked from commit 7b39cd631e0d3c3d238015c6f450c59bbc9cbc5b) Upstream-PR: https://github.com/NixOS/nix/pull/11585 Change-Id: `Ia973420f6098113da05a594d48394ce1fe41fbb9`	2024-09-25 18:40:58 -07:00

Tom Bereknyei

6334e91b2f

feat: better warning for common SSL errors

(cherry picked from commit 3e5bf903413f420c1f997e4b55140761172b8434)
Upstream-PR: https://github.com/NixOS/nix/pull/11246
Change-Id: Iccd92721bbcd92604a4b0e5c845242bdf3dd0f66

2024-11-18 16:49:35 -08:00

Puck Meerburg

37b22dae04

Fix passing custom CA files into the builtin:fetchurl sandbox

Without this, verifying TLS certificates would fail on macOS, as well
as any system that doesn't have a certificate file at /etc/ssl/certs/ca-certificates.crt,
which includes e.g. Fedora.

Change-Id: Iaa2e0e9db3747645b5482c82e3e0e4e8f229f5f9

2024-09-26 15:25:28 +00:00

Eelco Dolstra

c1631b0a39

[security] builtin:fetchurl: Enable TLS verification

This is better for privacy and to avoid leaking netrc credentials in a
MITM attack, but also the assumption that we check the hash no longer
holds in some cases (in particular for impure derivations).

Partially reverts 5db358d4d7.

(cherry picked from commit c04bc17a5a0fdcb725a11ef6541f94730112e7b6)
(cherry picked from commit f2f47fa725fc87bfb536de171a2ea81f2789c9fb)
(cherry picked from commit 7b39cd631e0d3c3d238015c6f450c59bbc9cbc5b)

Upstream-PR: https://github.com/NixOS/nix/pull/11585

Change-Id: Ia973420f6098113da05a594d48394ce1fe41fbb9

2024-09-25 18:40:58 -07:00

3 commits