nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-29 13:41:00 +01:00
Code Activity

Verify TLS certificate before downloading binaries

Browse source 
The --insecure flag to curl tells curl not to bother checking if the TLS
certificate presented by the server actually matches the hostname
requested, and actually is issued by a trusted CA chain.  This almost
entirely negates any benefit from using TLS in the first place.

This removes the --insecure flag to ensure we actually have a secure
connection to the intended hostname before downloading binaries.

Manually tested locally within a dev-shell; was able to download
binaries from https://cache.nixos.org without issue.

[Note: --insecure was only used for fetching NARs, whose integrity is
verified by Nix anyway using the hash from the .narinfo. But if we can
fetch the .narinfo without --insecure, we can also fetch the .nar, so
there is not much point to using --insecure. --Eelco]
This commit is contained in:
Philip Potter 2015-03-04 20:08:40 +00:00 • committed by Eelco Dolstra
parent 39d1da7b51
commit 4f3cf06c97
2 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/download-using-manifests.pl.in
View file

@ -17,8 +17,7 @@ my $logFile = "$Nix::Config::logDir/downloads";
# estimating the expected download size.
my $fast = 1;
# ‘--insecure’ is fine because Nix verifies the hash of the result.
my $curl = "$Nix::Config::curl --fail --location --insecure";
my $curl = "$Nix::Config::curl --fail --location";
# Open the manifest cache and update it if necessary.