3 people a959290f41 libstore: use pasta for FODs if available ...

This allows using a userspace program, pasta, to handle comms between
the build sandbox, and the outside world; allowing for full isolation
including the network namespace, closing the "fixed-output derivation
talks to the host over an abstract domain socket" hole for good.

Fixes CVE-2025-46416.

Co-Authored-By: Puck Meerburg <puck@puckipedia.com>
Change-Id: Ifd499b7dbb3784600a6e842fede65fc031ff9f15

2025-06-24 10:49:49 +00:00

..

cgroups

libutil/cgroup: ensure that cleanup takes place even under interruptions

2025-06-17 22:20:37 +02:00

containers

libstore/build: cgroup delegation to sandbox

2025-06-10 20:50:00 +02:00

coredumps

Allow enabling core dumps from builds for nix & child processes

2024-05-16 17:11:21 -07:00

fetch-git

treewide: Stop using URL literals

2024-08-17 15:48:10 +00:00

io_uring

libstore/build: block io_uring

2024-07-25 18:24:45 +02:00

no-new-privileges

libstore/build: always enable seccomp filtering and no-new-privileges

2024-05-24 21:19:29 +00:00

setuid

libstore/build: use an allowlist approach to syscall filtering

2024-07-25 18:24:40 +02:00

authorization.nix

Allow to sign path as unprivileged user

2023-06-27 18:31:31 +02:00

broken-userns.nix

Fix /etc/group having desynced IDs from the actual UID in the sandbox

2024-05-04 17:36:50 -07:00

default.nix

libstore: use pasta for FODs if available

2025-06-24 10:49:49 +00:00

fetchurl.nix

libstore: use pasta for FODs if available

2025-06-24 10:49:49 +00:00

github-flakes.nix

Deprecate the online flake registries and vendor the default registry

2024-05-18 12:27:23 +10:00

nix-copy-closure.nix

flake/inputs: 24.11-small -> 25.05-small

2025-06-13 18:15:47 +00:00

nix-copy.nix

tests: stop using OCR for nix copy tests

2024-10-26 17:50:54 +00:00

nix-upgrade-nix.nix

nix3-upgrade-nix: always use the /new/ nix-env to perform the installation

2024-07-15 15:26:53 -06:00

nss-preload.nix

Merge pull request #9631 from cole-h/fixup-check-warnings

2024-03-07 09:58:15 +01:00

remote-builds-ssh-ng.nix

libstore/ssh: remove echo started check

2025-05-18 18:45:26 +02:00

remote-builds.nix

libstore: stop using ssh connection sharing

2025-04-21 13:43:44 +00:00

s3-cache.nix

libstore/s3: fulfill with PutObjectOutcome instead of HeadObjectOutcome

2025-06-22 19:45:53 +00:00

sourcehut-flakes.nix

tests: unhaunt the flakes nixos tests

2024-04-18 20:09:19 +00:00

symlink-resolvconf.nix

libstore/build: set NO_NEW_PRIVS for the sandbox

2024-04-15 10:25:29 +03:00

tarball-flakes.nix

libfetchers: ensure that lastModified is a uint64_t

2025-03-13 09:34:59 +01:00

util.nix

Allow enabling core dumps from builds for nix & child processes

2024-05-16 17:11:21 -07:00