fix passing CA files into builtins:fetchurl sandbox

[Mic92]

Motivation

Context

CA as in Certificate Authority

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[edolstra]

Not sure this is the right solution. We're already bind-mounting the CA file into the sandbox (see LocalDerivationGoal::runChild()). Doesn't that work for builtin:fetchurl?

Alternatively, if we're passing caData into the sandbox, then we can get rid of the bind-mounting.

[Mic92]

I can look into using bind mount instead.

[Mic92]

So:

pathsInChroot.try_emplace("/etc/ssl/certs/ca-certificates.crt", canonPath(caFile, true), true)

Works on platforms that have the certificate in this location.
However this won't work on some linux distributions such as openSUSE, which use a different location. Could we potentially use NIX_SSL_CERT_FILE here? Than users can also override this in case they cannot modify /etc.

[edolstra]

@Mic92 /etc/ssl/certs/ca-certificates.crt is the location used inside the sandbox. The location outside the sandbox is caFile, which should be NIX_SSL_CERT_FILE.

[Mic92]

Ok. I have to check why it fails than anyway.

[puckipedia]

@Mic92 /etc/ssl/certs/ca-certificates.crt is the location used inside the sandbox. The location outside the sandbox is caFile, which should be NIX_SSL_CERT_FILE.

This is not true in a very important case: the macOS sandbox. It cannot bind-mount, and thus the location of the certificate may not be found. (Though, due to other circumstances, the macOS sandbox doesn't work on builtin:fetchurl either way, so uh. might be a bit of a moot point.)

Alongside that, the other issue is that on Linux, builtin:fetchurl will use the caFile option from outside the sandbox, causing it to ignore /etc/ssl/certs/ca-certificates.crt if it doesn't exist outside the sandbox. I decided to go for an approach that'd work on macOS always, without special-casing a single file outside the normal sandboxed paths, that might conflict with paths inside the sandbox (e.g. if the certificate file exists inside the Nix store.)

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-09-30-nix-team-meeting-minutes-182/53814/1