From a169553f7e3b61b7390106d658dbc718e98ac1a1 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 23 Sep 2024 18:27:02 +0200 Subject: [PATCH] fetchurl: enable TLS verification when credentials are used This make sure the credentials cannot be leaked in a MITM attack. Note that this change might break some existing deployments if the users tries to fetch resources on endpoints with invalid certificates. The impacted users will have the following choices: * fix the endpoint providing the resource * override SSL_CERT_FILE to either disable the verification (not recommended) or to set it to a path including their CA certificate. --- pkgs/build-support/fetchurl/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix index a9c2c7c46d14dfc..2901501afaab40e 100644 --- a/pkgs/build-support/fetchurl/default.nix +++ b/pkgs/build-support/fetchurl/default.nix @@ -164,7 +164,8 @@ stdenvNoCC.mkDerivation (( # New-style output content requirements. inherit (hash_) outputHashAlgo outputHash; - SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash) + # Disable TLS verification only when we know the hash and no credentials are needed to access the ressource + SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash || netrcPhase != null) then "${cacert}/etc/ssl/certs/ca-bundle.crt" else "/no-cert-file.crt";