diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2024-09-23 15:09:44 +0200 |
|---|---|---|
| committer | Jade Lovelace <lix@jade.fyi> | 2024-09-25 18:40:58 -0700 |
| commit | c1631b0a39d34267345b41214f1f5e8a77d98cd2 (patch) | |
| tree | 7345d79929d07ceeb56c857f5388a769f0bf228c /doc | |
| parent | 8a6b84df147f5f38bae710fac9ec085d9d4e8ded (diff) | |
[security] builtin:fetchurl: Enable TLS verification
This is better for privacy and to avoid leaking netrc credentials in a
MITM attack, but also the assumption that we check the hash no longer
holds in some cases (in particular for impure derivations).
Partially reverts https://github.com/NixOS/nix/commit/5db358d4d78aea7204a8f22c5bf2a309267ee038.
(cherry picked from commit c04bc17a5a0fdcb725a11ef6541f94730112e7b6)
(cherry picked from commit f2f47fa725fc87bfb536de171a2ea81f2789c9fb)
(cherry picked from commit 7b39cd631e0d3c3d238015c6f450c59bbc9cbc5b)
Upstream-PR: https://github.com/NixOS/nix/pull/11585
Change-Id: Ia973420f6098113da05a594d48394ce1fe41fbb9
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/manual/rl-next/verify-tls.md | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/doc/manual/rl-next/verify-tls.md b/doc/manual/rl-next/verify-tls.md new file mode 100644 index 000000000..608f3347e --- /dev/null +++ b/doc/manual/rl-next/verify-tls.md @@ -0,0 +1,10 @@ +--- +synopsis: "`<nix/fetchurl.nix>` now uses TLS verification" +category: Fixes +prs: [11585] +credits: edolstra +--- + +Previously `<nix/fetchurl.nix>` did not do TLS verification. This was because the Nix sandbox in the past did not have access to TLS certificates, and Nix checks the hash of the fetched file anyway. However, this can expose authentication data from `netrc` and URLs to man-in-the-middle attackers. In addition, Nix now in some cases (such as when using impure derivations) does *not* check the hash. Therefore we have now enabled TLS verification. This means that downloads by `<nix/fetchurl.nix>` will now fail if you're fetching from a HTTPS server that does not have a valid certificate. + +`<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. |