mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(tvix/glue): reject unknown attrset args for fetch builtins

Browse source 
This now uses UnexpectedArgumentBuiltin in case builtins.fetchurl or
builtins.fetchTarball are called with the wrong arguments:

```
note: while evaluating this Nix code
 --> [code]:1:1
  |
1 | builtins.readDir (builtins.fetchTarball { url = "https://git"; hash = "sha1-NKNeU1csW5YJ4lCeWH3Z/apppNU=";})
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
error[E040]: Unexpected agrument `"hash"` passed to builtin
 --> [code]:1:19
  |
1 | builtins.readDir (builtins.fetchTarball { url = "https://git"; hash = "sha1-NKNeU1csW5YJ4lCeWH3Z/apppNU=";})
  |                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ while calling this builtin

```

Change-Id: I51124255a46b78d3cf4dc89a1eca9e68750858d4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/11878
Reviewed-by: Ilan Joselevich <personal@ilanjoselevich.com>
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: Simon Hauser <simon.hauser@helsinki-systems.de>
Tested-by: BuildkiteCI
This commit is contained in:
Florian Klink 2024-06-25 22:46:34 +03:00 committed by flokli
parent aa7d125c12
commit cd48566173
3 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
tvix/glue/src/builtins/fetchers.rs
View file

@ -60,7 +60,14 @@ async fn extract_fetch_args(
Err(cek) => return Ok(Err(cek)),
};
// TODO: disallow other attrset keys, to match Nix' behaviour.
// Disallow other attrset keys, to match Nix' behaviour.
// We complain about the first unexpected key we find in the list.
const VALID_KEYS: [&[u8]; 3] = [b"url", b"name", b"sha256"];
if let Some(first_invalid_key) = attrs.keys().find(|k| !&VALID_KEYS.contains(&k.as_bytes())) {
return Err(ErrorKind::UnexpectedArgumentBuiltin(
first_invalid_key.clone(),
));
}
// parse the sha256 string into a digest.
let sha256 = match sha256_str {

5
tvix/glue/src/tests/tvix_tests/eval-fail-fetchtarball-invalid-attrs.nix Normal file
View file

@ -0,0 +1,5 @@
(builtins.fetchTarball {
url = "https://test.example/owo";
# Only "sha256" is accepted here.
hash = "sha256-Xa1Jbl2Eq5+L0ww+Ph1osA3Z/Dxe/RkN1/dITQCdXFk=";
})

5
tvix/glue/src/tests/tvix_tests/eval-fail-fetchurl-invalid-attrs.nix Normal file
View file

@ -0,0 +1,5 @@
(builtins.fetchurl {
url = "https://test.example/owo";
# Only "sha256" is accepted here.
hash = "sha256-Xa1Jbl2Eq5+L0ww+Ph1osA3Z/Dxe/RkN1/dITQCdXFk=";
})