fetchurl: enable TLS verification when credentials are used (#344000)

NixOS · Sep 23, 2024 · ee35dc7 · ee35dc7
2 parents 81c2eef + a169553
commit ee35dc7
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
@@ -164,7 +164,8 @@ stdenvNoCC.mkDerivation ((
  # New-style output content requirements.
  inherit (hash_) outputHashAlgo outputHash;
 
- SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash)
+ # Disable TLS verification only when we know the hash and no credentials are needed to access the ressource
+ SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash || netrcPhase != null)
  then "${cacert}/etc/ssl/certs/ca-bundle.crt"
  else "/no-cert-file.crt";