picnoir/nix-gh
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Make the hashes mirrors used by builtins.fetchurl configurable

Browse source 
In particular, this allows it to be disabled in our tests.
This commit is contained in:
Eelco Dolstra 2017-07-17 13:07:08 +02:00
parent 4ec6eb1fdf
commit 49304bae81
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
4 changed files with 42 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
doc/manual/command-ref/conf-file.xml
View file

@ -660,6 +660,34 @@ password <replaceable>my-password</replaceable>
</varlistentry>
<varlistentry xml:id="conf-hashed-mirrors"><term><literal>hashed-mirrors</literal></term>
<listitem><para>A list of web servers used by
<function>builtins.fetchurl</function> to obtain files by
hash. The default is
<literal>http://tarballs.nixos.org/</literal>. Given a hash type
<replaceable>ht</replaceable> and a base-16 hash
<replaceable>h</replaceable>, Nix will try to download the file
from
<literal>hashed-mirror/<replaceable>ht</replaceable>/<replaceable>h</replaceable></literal>.
This allows files to be downloaded even if they have disappeared
from their original URI. For example, given the default mirror
<literal>http://tarballs.nixos.org/</literal>, when building the derivation
<programlisting>
builtins.fetchurl {
url = https://example.org/foo-1.2.3.tar.xz;
sha256 = "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae";
}
</programlisting>
Nix will attempt to download this file from
<literal>http://tarballs.nixos.org/sha256/2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae</literal>
first. If it is not available there, if will try the original URI.</para></listitem>
</varlistentry>
</variablelist>
</para>

15
src/libstore/builtins.cc
View file

@ -38,12 +38,15 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData)
std::shared_ptr<std::string> data;
try {
if (getAttr("outputHashMode") == "flat")
data = fetch("http://tarballs.nixos.org/" + getAttr("outputHashAlgo") + "/" + getAttr("outputHash"));
} catch (Error & e) {
debug(e.what());
}
if (getAttr("outputHashMode") == "flat")
for (auto hashedMirror : settings.hashedMirrors.get())
try {
if (!hasSuffix(hashedMirror, "/")) hashedMirror += '/';
data = fetch(hashedMirror + getAttr("outputHashAlgo") + "/" + getAttr("outputHash"));
break;
} catch (Error & e) {
debug(e.what());
}
if (!data) data = fetch(getAttr("url"));

3
src/libstore/globals.hh
View file

@ -327,6 +327,9 @@ public:
"Whether builders can acquire new privileges by calling programs with "
"setuid/setgid bits or with file capabilities."};
#endif
Setting<Strings> hashedMirrors{this, {"http://tarballs.nixos.org/"}, "hashed-mirrors",
"A list of servers used by builtins.fetchurl to fetch files by hash."};
};

4
tests/fetchurl.sh
View file

@ -5,7 +5,7 @@ clearStore
# Test fetching a flat file.
hash=$(nix-hash --flat --type sha256 ./fetchurl.sh)
outPath=$(nix-build '<nix/fetchurl.nix>' --argstr url file://$(pwd)/fetchurl.sh --argstr sha256 $hash --no-out-link)
outPath=$(nix-build '<nix/fetchurl.nix>' --argstr url file://$(pwd)/fetchurl.sh --argstr sha256 $hash --no-out-link --option hashed-mirrors '')
cmp $outPath fetchurl.sh
@ -14,7 +14,7 @@ clearStore
hash=$(nix hash-file --type sha512 --base64 ./fetchurl.sh)
outPath=$(nix-build '<nix/fetchurl.nix>' --argstr url file://$(pwd)/fetchurl.sh --argstr sha512 $hash --no-out-link)
outPath=$(nix-build '<nix/fetchurl.nix>' --argstr url file://$(pwd)/fetchurl.sh --argstr sha512 $hash --no-out-link --option hashed-mirrors '')
cmp $outPath fetchurl.sh