feat: add reject-flake-config setting to reject all nix config from flakes

This commit is contained in:
éclairevoyant 2024-02-15 12:48:16 -05:00
parent 661b025c79
commit 88d8f74152
No known key found for this signature in database
GPG key ID: E3813AEAA02DB54B
3 changed files with 14 additions and 0 deletions

View file

@ -27,6 +27,11 @@ The following experimental features are enabled by default:
- `repl-flake` (`Xp::ReplFlake`)
- `fetch-tree` (`Xp::FetchTree`)
### Additional settings
The following settings are added to this fork:
- `reject-flake-config`: rejects all flake configuration (including whitelisted settings) and warns about it
### Full thunk evaluation in `flake.nix`
In stock Nix, only the outputs section of `flake.nix` is able to make full use of the Nix language.

View file

@ -51,6 +51,11 @@ void ConfigFile::apply()
else
assert(false);
if (nix::fetchSettings.rejectFlakeConfig) {
warn("ignoring untrusted flake configuration setting '%s' due to the '%s' setting.", name, "reject-flake-config");
continue;
}
if (!whitelist.count(baseName) && !nix::fetchSettings.acceptFlakeConfig) {
bool trusted = false;
auto trustedList = readTrustedList();

View file

@ -87,6 +87,10 @@ struct FetchSettings : public Config
"Whether to accept nix configuration from a flake without prompting.",
{}, true, Xp::Flakes};
Setting<bool> rejectFlakeConfig{this, false, "reject-flake-config",
"Whether to reject nix configuration (including whitelisted settings) from a flake without prompting.",
{}, true, Xp::Flakes};
Setting<std::string> commitLockFileSummary{
this, "", "commit-lockfile-summary",
R"(