diff options
| author | Alyssa Ross <hi@alyssa.is> | 2023-10-31 22:19:45 +0100 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2023-10-31 22:19:45 +0100 |
| commit | 78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc (patch) | |
| tree | fd9cfb92edfaa37c919be8d24063b8a6c6d94c83 /nixpkgs/pkgs/stdenv/generic | |
| parent | 7e0c8fe656bbc2fcbdfc3e03a367d2c6ff389769 (diff) | |
| parent | 0cbe9f69c234a7700596e943bfae7ef27a31b735 (diff) | |
| download | nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar.gz nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar.bz2 nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar.lz nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar.xz nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.tar.zst nixlib-78ba0c65b7bf9a64c12ca8c08f2e0220afdc8dbc.zip | |
Merge commit '0cbe9f69c234a7700596e943bfae7ef27a31b735' into HEAD
Diffstat (limited to 'nixpkgs/pkgs/stdenv/generic')
| -rw-r--r-- | nixpkgs/pkgs/stdenv/generic/make-derivation.nix | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/stdenv/generic/make-derivation.nix b/nixpkgs/pkgs/stdenv/generic/make-derivation.nix index beba687e788a..d235ffefaab4 100644 --- a/nixpkgs/pkgs/stdenv/generic/make-derivation.nix +++ b/nixpkgs/pkgs/stdenv/generic/make-derivation.nix @@ -165,6 +165,17 @@ let , ... } @ attrs: +# Policy on acceptable hash types in nixpkgs +assert attrs ? outputHash -> ( + let algo = + attrs.outputHashAlgo or (lib.head (lib.splitString "-" attrs.outputHash)); + in + if algo == "md5" then + throw "Rejected insecure ${algo} hash '${attrs.outputHash}'" + else + true +); + let # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when # no package has `doCheck = true`. |