Commit graph

5 commits

Author SHA1 Message Date
Maximilian Bosch
e9bde1ace0
module: prohibit store-paths for environmentFile
The store is world-readable, so secrets shouldn't end up there in the
first place. On top, `types.path` has the following behavior:

* `toString foo` returns the absolute path
* `${foo}` copies the path silently into the store and returns the
  store-path.

This happens without any real feedback, so this can be caused by an
innocent looking change.

To address this problem, `pathsWith` was introduced into <nixpkgs/lib>
which allows absolute paths represented as string, but rejects things
pointing to the store and path literals which may be copied later on.
2025-04-28 13:52:51 +02:00
WilliButz
dbfc2207df
treewide: nixfmt 2025-02-02 14:25:09 +01:00
WilliButz
ee7e7ed147
tests: improve vmtest
`wait_for_text()` takes a regex and it seems that sometimes OCR fails to
recognize the dots in the version string. To make this more resilient,
zero or one symbol is not matched between the numerical components of
the version string.
2024-09-07 22:07:37 +02:00
WilliButz
eb572302be
tests/minimal-vmtest: fix version check
It's now further up :)
2024-02-21 22:12:02 +01:00
WilliButz
1b9f4dce95
test: move to tests dir 2023-12-10 15:16:53 +01:00
Renamed from test.nix (Browse further)