diff options
| author | Puck Meerburg <puck@puckipedia.com> | 2024-09-26 15:12:24 +0000 |
|---|---|---|
| committer | Puck Meerburg <puck@puckipedia.com> | 2024-09-26 15:25:28 +0000 |
| commit | 37b22dae04f2da214e6b9bef3427e134280642ca (patch) | |
| tree | 0e1980bab2adcd8def2e55b20ae2c90abfff4104 /src/libstore/builtins | |
| parent | c1631b0a39d34267345b41214f1f5e8a77d98cd2 (diff) | |
Fix passing custom CA files into the builtin:fetchurl sandbox
Without this, verifying TLS certificates would fail on macOS, as well
as any system that doesn't have a certificate file at /etc/ssl/certs/ca-certificates.crt,
which includes e.g. Fedora.
Change-Id: Iaa2e0e9db3747645b5482c82e3e0e4e8f229f5f9
Diffstat (limited to 'src/libstore/builtins')
| -rw-r--r-- | src/libstore/builtins/fetchurl.cc | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/libstore/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc index 3fb769fe6..b28eb01d0 100644 --- a/src/libstore/builtins/fetchurl.cc +++ b/src/libstore/builtins/fetchurl.cc @@ -7,7 +7,7 @@ namespace nix { -void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData) +void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData, const std::string & caFileData) { /* Make the host's netrc data available. Too bad curl requires this to be stored in a file. It would be nice if we could just @@ -17,6 +17,9 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData) writeFile(settings.netrcFile, netrcData, 0600); } + settings.caFile = "ca-certificates.crt"; + writeFile(settings.caFile, caFileData, 0600); + auto getAttr = [&](const std::string & name) { auto i = drv.env.find(name); if (i == drv.env.end()) throw Error("attribute '%s' missing", name); |