nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-25 08:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fetchPypiLegacy: Pass cacert to enable TLS verification when username/password is used

Browse Source 
The intent was for TLS verification to be enabled when transfering credentials only, and normally disabled for long-term reproducibility.

See https://github.com/nix-community/poetry2nix/issues/1740
This commit is contained in:
adisbladis 2024-08-14 13:20:21 +12:00
parent 6aad68f7ca
commit bed19bdf39
1 changed files with 49 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
pkgs/build-support/fetchpypilegacy/default.nix
View File

@ -3,7 +3,8 @@
runCommand, runCommand,
lib, lib,
python3, python3,
}: cacert,
}@pkgs:
let let
inherit (lib) inherit (lib)
optionalAttrs optionalAttrs
@ -18,7 +19,8 @@ let
impureEnvVars = fetchers.proxyImpureEnvVars ++ optional inPureEvalMode "NETRC"; impureEnvVars = fetchers.proxyImpureEnvVars ++ optional inPureEvalMode "NETRC";
in in
{ lib.makeOverridable (
{
# package name # package name
pname, pname,
# Package index # Package index
@ -31,20 +33,25 @@ in
hash, hash,
# allow overriding the derivation name # allow overriding the derivation name
name ? null, name ? null,
}: # allow overriding cacert using src.override { cacert = cacert.override { extraCertificateFiles = [ ./path/to/cert.pem ]; }; }
let cacert ? pkgs.cacert,
}:
let
urls' = urls ++ optional (url != null) url; urls' = urls ++ optional (url != null) url;
pathParts = filter ({ prefix, path }: "NETRC" == prefix) builtins.nixPath; pathParts = filter ({ prefix, path }: "NETRC" == prefix) builtins.nixPath;
netrc_file = if (pathParts != [ ]) then (head pathParts).path else ""; netrc_file = if (pathParts != [ ]) then (head pathParts).path else "";
in in
# Assert that we have at least one URL # Assert that we have at least one URL
assert urls' != [ ]; assert urls' != [ ];
runCommand file runCommand file
( (
{ {
nativeBuildInputs = [ python3 ]; nativeBuildInputs = [
python3
cacert
];
inherit impureEnvVars; inherit impureEnvVars;
outputHashMode = "flat"; outputHashMode = "flat";
# if hash is empty select a default algo to let nix propose the actual hash. # if hash is empty select a default algo to let nix propose the actual hash.
@ -60,3 +67,4 @@ runCommand file
} --pname ${pname} --filename ${file} } --pname ${pname} --filename ${file}
mv ${file} $out mv ${file} $out
'' ''
)