nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-27 04:30:59 +01:00
Code Activity

Nix now includes the username into the hash calculation, statepaths are also recomputed at buildtime so they cannot be spoofed

Browse source
This commit is contained in:
Wouter den Breejen 2007-06-11 16:43:32 +00:00
parent 267ccc589d
commit 95ce7e04b7
12 changed files with 111 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/libstore/store-api.cc
View file

@ -79,24 +79,44 @@ Path makeStorePath(const string & type, const Hash & hash, const string & suffix
+ "-" + suffix;
}
Path makeStatePath(const string & type, const Hash & hash, const string & suffix, const string & stateIdentifier)
Path makeStatePath(const string & componentHash, const string & suffix, const string & stateIdentifier)
{
string suffix_stateIdentifier = stateIdentifier;
if(suffix_stateIdentifier != "")
suffix_stateIdentifier = "-" + suffix_stateIdentifier;
string username = getCallingUserName(); //Can and Should NOT be faked
/* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
string s = type + ":sha256:" + printHash(hash) + ":"
+ nixStoreState + ":" + suffix + ":" + stateIdentifier;
string s = ":sha256:" + componentHash + ":"
+ nixStoreState + ":" + suffix + ":" + stateIdentifier + ":" + username;
checkStoreName(suffix);
checkStoreName(stateIdentifier);
return nixStoreState + "/"
+ printHash32(compressHash(hashString(htSHA256, s), 20))
+ "-" + suffix + suffix_stateIdentifier;
return nixStoreState + "/"
+ printHash32(compressHash(hashString(htSHA256, s), 20))
+ "-" + suffix + suffix_stateIdentifier;
}
void checkStatePath(const Derivation & drv)
{
Path drvPath = drv.stateOutputs.find("state")->second.statepath;
string componentHash = drv.stateOutputs.find("state")->second.componentHash;
string suffix = drv.env.find("name")->second;
string stateIdentifier = drv.stateOutputs.find("state")->second.stateIdentifier;
Path calculatedPath = makeStatePath(componentHash, suffix, stateIdentifier);
printMsg(lvlError, format("CHECK: %1% %2%") % drvPath % calculatedPath);
if(drvPath != calculatedPath)
Error(format("The statepath from the Derivation does not match the recalculated statepath, are u trying to spoof the statepath?"));
}
Path makeStateReposPath(const string & type, const Path statePath, const string subfolder, const string & suffix, const string & stateIdentifier)
{
//This is a little trick: we could use the same hash as the statepath, but we change it so the repository also gets a unique scannable hash