NixOS/nix
NixOS/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2024-09-18 10:30:23 -04:00
Code Activity

feat: use OSX keychain

Browse source
This commit is contained in:
Tom Bereknyei 2024-08-02 17:51:29 -04:00 committed by Tom Bereknyei
parent 09199a40cd
commit 849b52cc88
2 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/libstore/globals.cc
View file

@ -77,6 +77,23 @@ Settings::Settings()
if (sslOverride != "")
caFile = sslOverride;
#ifdef __APPLE__
if(caFile.get().starts_with("keychain:")){
debug("reading %s",caFile.get());
auto caContents = runProgram("/usr/bin/security", false, {"find-certificate", "-a", "-p", caFile.get().substr(9)});
if (caContents.empty()){
warn("reading '%s' found no certificates",caFile.get());
}
auto caFilePath = settings.nixConfDir + "/ssl-cert-file.keychain";
auto caFilePathTmp = caFilePath + ".tmp";
debug("writing to %s",caFilePathTmp);
writeFile(caFilePathTmp.c_str(),caContents);
// check failure?
std::rename(caFilePathTmp.c_str(), caFilePath.c_str());
caFile = caFilePath;
}
#endif
/* Backwards compatibility. */
auto s = getEnv("NIX_REMOTE_SYSTEMS");
if (s) {

6
src/libstore/globals.hh
View file

@ -1061,6 +1061,12 @@ public:
1. `NIX_SSL_CERT_FILE`
2. `SSL_CERT_FILE`
Darwin only: The path can also be of form keychain:/path-to-keychain
which will read the OSX keychain and write it to the config directory
and use that file as the CA file. For example, setting
"keychain:/System/Library/Keychains/SystemRootCertificates.keychain"
will write to "/etc/nix/ssl-cert-file.keychain".
)"};
#if __linux__