max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-22 05:56:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

builtin:fetchurl: Ensure a fixed-output derivation

Browse source 
Previously we didn't check that the derivation was fixed-output, so
you could use builtin:fetchurl to impurely fetch a file.
This commit is contained in:
Eelco Dolstra 2024-02-01 21:46:01 +01:00
parent ef6d055ace
commit 1ee42c5b88
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/libstore/builtins/fetchurl.cc
View file

@ -16,6 +16,9 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData)
writeFile(settings.netrcFile, netrcData, 0600);
}
if (!drv.type().isFixed())
throw Error("'builtin:fetchurl' must be a fixed-output derivation");
auto getAttr = [&](const std::string & name) {
auto i = drv.env.find(name);
if (i == drv.env.end()) throw Error("attribute '%s' missing", name);

3
tests/functional/fetchurl.sh
View file

@ -78,3 +78,6 @@ outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:
test -x $outPath/fetchurl.sh
test -L $outPath/symlink
# Make sure that *not* passing a outputHash fails.
expectStderr 100 nix-build --expr '{ url }: builtins.derivation { name = "nix-cache-info"; system = "x86_64-linux"; builder = "builtin:fetchurl"; inherit url; outputHashMode = "flat"; }' --argstr url file://$narxz 2>&1 | grep 'must be a fixed-output derivation'