Raito Bezarius
2d0109898a
Historically, Nix would support copying certificate authorities inside the sandbox so you could use them. In addition to that, the primitives consisting of leaking environment variables via `impureEnvVars` and `extra-sandbox-paths` to render paths external to the sandbox visible to the builder would also constitute a mechanism to expose special inodes which should have no influence on the output result, e.g. interception CAs. Unfortunately, in nixpkgs, `lib.fetchers.proxyImpureEnvVars` set `NIX_SSL_CERT_FILE` as an impure environment variable. A confused user may set `ssl-cert-file` via `NIX_SSL_CERT_FILE` outside the builder believing that this will set magically the right `NIX_SSL_CERT_FILE` inside the sandbox, but this is not true. The combination of impure environment variables and setting `caFile` creates a weird interaction where `NIX_SSL_CERT_FILE` points to an "outside the builder's world" inode *AND* `ssl-cert-file` creates this very same certificate file in /etc/ssl/certs/ca-certificates.crt without rewriting the environment variable. This footgun is closed by making these two features mutually incompatible with a warning and forcibly rewriting the SSL family of environment variables even if it was set via impure environment variables. Users who truly meant to use `impureEnvVars` can obtain the right behavior by setting `ssl-cert-file` to an empty string and will have to use `extra-sandbox-paths`. Users who meant to use `ssl-cert-file` will have everything work automatically with a warning hinting at nixpkgs *fixing its own bug*, i.e. passing `NIX_SSL_CERT_FILE` as an impure environment variable and expecting the Nix interpreter to magically reconcile the diverging values or expecting the user to actually do the work to render the path visible available via `extra-sandbox-paths`. Fixes #885. Change-Id: I32f8b5ce20fe9b6a911768114c92f95fc886cc07 Signed-off-by: Raito Bezarius <raito@lix.systems>
Lix
Lix is an implementation of Nix, a powerful package management system for Linux and other Unix systems that makes package management reliable and reproducible.
Read more about us at https://lix.systems.
Installation
On Linux and macOS the easiest way to install Lix is to run the following shell command (as a user other than root):
$ curl -sSf -L https://install.lix.systems/lix | sh -s -- install
For systems that already have a Nix implementation installed, such as NixOS systems, read our install page
Building And Developing
See our Hacking guide in our manual for instruction on how to set up a development environment and build Lix from source.
Additional Resources
- The Lix reference manual:
- Our wiki
- Matrix - #space:lix.systems
License
Lix is released under LGPL-2.1-or-later.