Reject fully-qualified URLs in 'from' argument of nix registry add

We previously allowed you to map any flake URL to any other flake URL,
including shorthand flakerefs, indirect flake URLs like `flake:nixpkgs`,
direct flake URLs like `github:NixOS/nixpkgs`, or local paths.

But flake registry entries mapping from direct flake URLs often come
from swapping the 'from' and 'to' arguments by accident, and even when
created intentionally, they may not actually work correctly.

This patch rejects those URLs (and fully-qualified flake: URLs), making
it harder to swap the arguments by accident.

Fixes #181.

Change-Id: I24713643a534166c052719b8770a4edfcfdb8cf3
This commit is contained in:
Delan Azabani 2024-06-22 23:00:59 +08:00
parent 5dc85e8b72
commit b2944d93a6
8 changed files with 44 additions and 5 deletions

View file

@ -44,6 +44,11 @@ cole-h:
display_name: Cole Helbling
github: cole-h
delan:
display_name: delan
forgejo: delan
github: delan
edolstra:
display_name: Eelco Dolstra
github: edolstra

View file

@ -0,0 +1,10 @@
---
synopsis: "`nix registry add` now requires a shorthand flakeref on the 'from' side"
cls: 1494
credits: delan
category: Improvements
---
The 'from' argument must now be a shorthand flakeref like `nixpkgs` or `nixpkgs/nixos-20.03`, making it harder to accidentally swap the 'from' and 'to' arguments.
Registry entries that map from other flake URLs can still be specified in registry.json, the `nix.registry` option in NixOS, or the `--override-flake` option in the CLI, but they are not guaranteed to work correctly.

View file

@ -85,8 +85,8 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
+ "(?:#(" + queryRegex + "))?",
std::regex::ECMAScript);
static std::regex flakeRegex(
"((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)"
static std::regex flakeShorthandRegex(
flakeShorthandRegexS
+ "(?:#(" + queryRegex + "))?",
std::regex::ECMAScript);
@ -95,7 +95,7 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
/* Check if 'url' is a flake ID. This is an abbreviated syntax for
'flake:<flake-id>?ref=<ref>&rev=<rev>'. */
if (std::regex_match(url, match, flakeRegex)) {
if (std::regex_match(url, match, flakeShorthandRegex)) {
auto parsedURL = ParsedURL{
.url = url,
.base = "flake:" + match.str(1),

View file

@ -46,4 +46,7 @@ const static std::string refAndOrRevRegex = "(?:(" + revRegexS + ")|(?:(" + refR
const static std::string flakeIdRegexS = "[a-zA-Z][a-zA-Z0-9_-]*";
extern std::regex flakeIdRegex;
const static std::string flakeShorthandRegexS = "((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)";
extern std::regex flakeShorthandRegex;
}

View file

@ -9,6 +9,7 @@ std::regex refRegex(refRegexS, std::regex::ECMAScript);
std::regex badGitRefRegex(badGitRefRegexS, std::regex::ECMAScript);
std::regex revRegex(revRegexS, std::regex::ECMAScript);
std::regex flakeIdRegex(flakeIdRegexS, std::regex::ECMAScript);
std::regex flakeShorthandRegex(flakeShorthandRegexS, std::regex::ECMAScript);
ParsedURL parseURL(const std::string & url)
{

View file

@ -31,8 +31,9 @@ R""(
# Description
This command adds an entry to the user registry that maps flake
reference *from-url* to flake reference *to-url*. If an entry for
*from-url* already exists, it is overwritten.
reference *from-url* to flake reference *to-url*, where *from-url*
must be a shorthand like 'nixpkgs' or 'nixpkgs/nixos-20.03'. If an
entry for *from-url* already exists, it is overwritten.
Entries can be removed using [`nix registry
remove`](./nix3-registry-remove.md).

View file

@ -5,6 +5,7 @@
#include "flake/flake.hh"
#include "store-api.hh"
#include "fetchers.hh"
#include "url-parts.hh"
#include "registry.hh"
using namespace nix;
@ -109,7 +110,14 @@ struct CmdRegistryAdd : MixEvalArgs, Command, RegistryCommand
void run() override
{
std::smatch match;
if (!std::regex_match(fromUrl, match, flakeShorthandRegex)) {
throw UsageError("'from-url' argument must be a shorthand like 'nixpkgs' or 'nixpkgs/nixos-20.03'");
}
auto fromRef = parseFlakeRef(fromUrl);
if (fromRef.input.direct) {
throw UsageError("'from-url' argument must be an indirect flakeref like 'nixpkgs' or 'flake:nixpkgs'");
}
auto toRef = parseFlakeRef(toUrl);
auto registry = getRegistry();
fetchers::Attrs extraAttrs;

View file

@ -366,6 +366,17 @@ nix registry pin flake1 flake3
nix registry remove flake1
[[ $(nix registry list | wc -l) == 5 ]]
# 'nix registry add' should accept flake shorthands (with or without branch or rev)
# in the from argument, but reject fully-qualified from-urls (direct or indirect).
nix registry add nixpkgz github:NixOS/nixpkgz
nix registry remove nixpkgz
nix registry add nixpkgz/branch github:NixOS/nixpkgz
nix registry remove nixpkgz/branch
nix registry add nixpkgz/branch/1db42b7fe3878f3f5f7a4f2dc210772fd080e205 github:NixOS/nixpkgz
nix registry remove nixpkgz/branch/1db42b7fe3878f3f5f7a4f2dc210772fd080e205
! nix registry add flake:nixpkgz github:NixOS/nixpkgz
! nix registry add github:NixOS/nixpkgz github:NixOS/nixpkgz
# Test 'nix registry list' with a disabled global registry.
nix registry add user-flake1 git+file://$flake1Dir
nix registry add user-flake2 git+file://$flake2Dir