Raito Bezarius 42e2bd045c libstore/build: automatic clean up of unsuccessfully built scratch outputs ...

When a build fails, its scratch output paths are not cleaned up.

Until recently, this was deemed not a problem but as part of the effort
to harden the Nix builds and protect these paths against being part of a
staged attack (race conditions, etc.), we automatically cleanup after
failed builds.

Fixes CVE-2025-52992.

Change-Id: I58481b1cc83826298b9d80d37fecf81f117ccb09
Signed-off-by: Raito Bezarius <raito@lix.systems>

2025-06-24 10:49:49 +00:00

..

internal-api

fix tooling after include reorganization

2024-11-19 22:55:32 +00:00

manual

libstore/build: automatic clean up of unsuccessfully built scratch outputs

2025-06-24 10:49:49 +00:00