mirror of
https://github.com/NixOS/nix.git
synced 2025-11-08 19:46:02 +01:00
11f9c59140
CURL is not very strict about validation of URLs passed to it. We
should reflect this in our handling of URLs that we get from the user
in <nix/fetchurl.nix> or builtins.fetchurl. ValidURL was an attempt to
rectify this, but it turned out to be too strict. The only good way to
resolve this is to pass (in some cases) the user-provided string verbatim
to CURL. Other usages in libfetchers still benefit from using structured
ParsedURL and validation though.
nix store prefetch-file --name foo 'https://cdn.skypack.dev/big.js@^5.2.2'
error: 'https://cdn.skypack.dev/big.js@^5.2.2' is not a valid URL: leftover
(cherry picked from commit 47f427a172)
90 lines
3.2 KiB
Bash
Executable file
90 lines
3.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
source common.sh
|
|
|
|
TODO_NixOS
|
|
|
|
clearStore
|
|
|
|
# Test fetching a flat file.
|
|
hash=$(nix-hash --flat --type sha256 ./fetchurl.sh)
|
|
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url "file://$(pwd)/fetchurl.sh" --argstr sha256 "$hash" --no-out-link)
|
|
|
|
cmp "$outPath" fetchurl.sh
|
|
|
|
# Do not re-fetch paths already present.
|
|
outPath2=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:///does-not-exist/must-remain-unused/fetchurl.sh --argstr sha256 "$hash" --no-out-link)
|
|
test "$outPath" == "$outPath2"
|
|
|
|
# Now using a base-64 hash.
|
|
clearStore
|
|
|
|
hash=$(nix hash file --type sha512 --base64 ./fetchurl.sh)
|
|
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url "file://$(pwd)/fetchurl.sh" --argstr sha512 "$hash" --no-out-link)
|
|
|
|
cmp "$outPath" fetchurl.sh
|
|
|
|
# Now using an SRI hash.
|
|
clearStore
|
|
|
|
hash=$(nix hash file ./fetchurl.sh)
|
|
|
|
[[ $hash =~ ^sha256- ]]
|
|
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url "file://$(pwd)/fetchurl.sh" --argstr hash "$hash" --no-out-link)
|
|
|
|
cmp "$outPath" fetchurl.sh
|
|
|
|
# Test that we can substitute from a different store dir.
|
|
clearStore
|
|
|
|
other_store="file://$TEST_ROOT/other_store?store=/fnord/store"
|
|
|
|
hash=$(nix hash file --type sha256 --base16 ./fetchurl.sh)
|
|
|
|
nix --store "$other_store" store add-file ./fetchurl.sh
|
|
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:///no-such-dir/fetchurl.sh --argstr sha256 "$hash" --no-out-link --substituters "$other_store")
|
|
|
|
# Test hashed mirrors with an SRI hash.
|
|
nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:///no-such-dir/fetchurl.sh --argstr hash "$(nix hash to-sri --type sha256 "$hash")" \
|
|
--no-out-link --substituters "$other_store"
|
|
|
|
# Test unpacking a NAR.
|
|
rm -rf "$TEST_ROOT/archive"
|
|
mkdir -p "$TEST_ROOT/archive"
|
|
cp ./fetchurl.sh "$TEST_ROOT/archive"
|
|
chmod +x "$TEST_ROOT/archive/fetchurl.sh"
|
|
ln -s foo "$TEST_ROOT/archive/symlink"
|
|
nar="$TEST_ROOT/archive.nar"
|
|
nix-store --dump "$TEST_ROOT/archive" > "$nar"
|
|
|
|
hash=$(nix-hash --flat --type sha256 "$nar")
|
|
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url "file://$nar" --argstr sha256 "$hash" \
|
|
--arg unpack true --argstr name xyzzy --no-out-link)
|
|
|
|
echo "$outPath" | grepQuiet 'xyzzy'
|
|
|
|
test -x "$outPath/fetchurl.sh"
|
|
test -L "$outPath/symlink"
|
|
|
|
nix-store --delete "$outPath"
|
|
|
|
# Test unpacking a compressed NAR.
|
|
narxz="$TEST_ROOT/archive.nar.xz"
|
|
rm -f "$narxz"
|
|
xz --keep "$nar"
|
|
outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url "file://$narxz" --argstr sha256 "$hash" \
|
|
--arg unpack true --argstr name xyzzy --no-out-link)
|
|
|
|
test -x "$outPath/fetchurl.sh"
|
|
test -L "$outPath/symlink"
|
|
|
|
# Make sure that *not* passing a outputHash fails.
|
|
requireDaemonNewerThan "2.20"
|
|
expected=100
|
|
if [[ -v NIX_DAEMON_PACKAGE ]]; then expected=1; fi # work around the daemon not returning a 100 status correctly
|
|
expectStderr $expected nix-build --expr '{ url }: builtins.derivation { name = "nix-cache-info"; system = "x86_64-linux"; builder = "builtin:fetchurl"; inherit url; outputHashMode = "flat"; }' --argstr url "file://$narxz" 2>&1 | grep 'must be a fixed-output or impure derivation'
|