max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-25 23:36:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

* Fix nix-prefetch-url in setuid Nix installations.

Browse source
This commit is contained in:
Eelco Dolstra 2004-10-20 14:40:54 +00:00
parent 99da51d4de
commit 88888160d2
1 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
scripts/nix-prefetch-url.in
View file

@ -7,9 +7,18 @@ if test -z "$url"; then
exit 1
fi
# !!! race? should be relatively safe, `svn export' barfs if $tmpPath exists.
# !!! race
tmpPath1=@storedir@/nix-prefetch-url-$$
# Test whether we have write permission in the store. If not, fetch
# to /tmp and don't copy to the store. This is a hack to make this
# script at least work somewhat in setuid installations.
if ! touch $tmpPath1 2> /dev/null; then
echo "(cannot write to the store, result won't be cached)" >&2
dummyMode=1
tmpPath1=/tmp/nix-prefetch-url-$$ # !!! security?
fi
# Perform the checkout.
@curl@ --fail --location --max-redirs 20 "$url" > $tmpPath1
@ -17,11 +26,13 @@ tmpPath1=@storedir@/nix-prefetch-url-$$
hash=$(@bindir@/nix-hash --flat $tmpPath1)
echo "hash is $hash" >&2
# Rename it so that the fetchsvn builder can find it.
tmpPath2=@storedir@/nix-prefetch-url-$hash
test -e $tmpPath2 || mv $tmpPath1 $tmpPath2 # !!! race
# Rename it so that the fetchurl builder can find it.
if test "$dummyMode" != 1; then
tmpPath2=@storedir@/nix-prefetch-url-$hash
test -e $tmpPath2 || mv $tmpPath1 $tmpPath2 # !!! race
fi
# Create a Nix expression that does a fetchsvn.
# Create a Nix expression that does a fetchurl.
storeExpr=$( \
echo "(import @datadir@/nix/corepkgs/fetchurl) \
{url = $url; md5 = \"$hash\"; system = \"@system@\";}" \
@ -32,7 +43,7 @@ finalPath=$(@bindir@/nix-store -qnB --force-realise $storeExpr)
echo "path is $finalPath" >&2
rm -rf $tmpPath2 || true
rm -rf $tmpPath1 $tmpPath2 || true
echo $hash