/nix/

Age	Commit message (Expand)	Author
2024-11-17	daemon: Improve error message in ‘checkStoreName’....* nix/libstore/store-api.cc (checkStoreName): Clarify message when NAME starts with a dot. Change-Id: I045a663bc6cd9844677c65b38a31d3941cf212b5 Signed-off-by: Ludovic Courtès <ludo@gnu.org>	Brennan Vincent
2024-10-21	daemon: Sanitize successful build outputs prior to exposing them....There is currently a window of time between when the build outputs are exposed and when their metadata is canonicalized. * nix/libstore/build.cc (DerivationGoal::registerOutputs): wait until after metadata canonicalization to move successful build outputs to the store. Change-Id: Ia995136f3f965eaf7b0e1d92af964b816f3fb276 Signed-off-by: Ludovic Courtès <ludo@gnu.org>	Reepca Russelstein
2024-10-21	daemon: Sanitize failed build outputs prior to exposing them....The only thing keeping a rogue builder and a local user from collaborating to usurp control over the builder's user during the build is the fact that whatever files the builder may produce are not accessible to any other users yet. If we're going to make them accessible, we should probably do some sanity checking to ensure that sort of collaborating can't happen. Currently this isn't happening when failed build outputs are moved from the chroot as an aid to debugging. * nix/libstore/build.cc (secureFilePerms): new function. (DerivationGoal::buildDone): use it. Change-Id: I9dce1e3d8813b31cabd87a0e3219bf9830d8be96 Signed-off-by: Ludovic Courtès <ludo@gnu.org>	Reepca Russelstein