Unverified Commit ee35dc7c authored by Martin Weinelt's avatar Martin Weinelt Committed by GitHub
Browse files

fetchurl: enable TLS verification when credentials are used (#344000)

parents 81c2eef9 a169553f

pkgs/build-support/fetchurl/default.nix

+2 −1
Original line number Diff line number Diff line
@@ -164,7 +164,8 @@ stdenvNoCC.mkDerivation (( 
  # New-style output content requirements.

  inherit (hash_) outputHashAlgo outputHash;



  SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash)

  # Disable TLS verification only when we know the hash and no credentials are needed to access the ressource

  SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash || netrcPhase != null)

                  then "${cacert}/etc/ssl/certs/ca-bundle.crt"

                  else "/no-cert-file.crt";