grahamc/hydra - Change D4QVCQUSU2W2GWCCI2SLCLM2QO3OYJ5QLGPKXSMZ6XUVIDW6PCTQC

Use hashFile instead of nix-hash

Calling a shell command is a security hole if $path contains special characters (e.g. "${foo}"). Observed in http://hydra.nixos.org/build/4041321.

Created by Eelco Dolstra on February 23, 2013

D4QVCQUSU2W2GWCCI2SLCLM2QO3OYJ5QLGPKXSMZ6XUVIDW6PCTQC

Dependencies

In channels

upstream

main

Change contents

Replacement in src/lib/Hydra/Helper/AddBuilds.pm at line 804 [4.2663]

∅:D[2.5961] → [3.417:418]

B:BD[5.2216] → [3.417:418]

B:BD[3.418] → [2.5962:6116]

∅:D[2.6116] → [3.419:420]

B:BD[5.2359] → [3.419:420]

B:BD[3.420] → [2.6117:6277]


                    $sha1 = `nix-hash --flat --type sha1 $path`
                        or die "cannot hash $path: $?";;
                    chomp $sha1;
                    $sha256 = `nix-hash --flat --type sha256 $path`
                        or die "cannot hash $path: $?";;
                    chomp $sha256;

[2.5961]

[2.6277]

                    $sha1 = hashFile("sha1", 0, $path);
                    $sha256 = hashFile("sha256", 0, $path);