ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-12-28 22:32:58 +03:00
Code Issues Projects Releases Wiki Activity

nixos/tests/letsencrypt: Don't substitute certs

Browse Source 
If one of the certificates of the chain gets substituted from a binary
cache and the rest is generated locally it might turn out that we get
invalid certificates, which in turn cause tests using this module to
fail.

So let's set allowSubstitutes to false for all derivations that are
involved with certificate/key generation.

Signed-off-by: aszlig <aszlig@nix.build>
This commit is contained in:
aszlig 2018-06-30 18:31:38 +02:00
parent bdb0b2db44
commit 0c7c1660f7
No known key found for this signature in database
GPG Key ID: 684089CE67EBB691
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/tests/common/letsencrypt.nix
View File

@ -193,6 +193,7 @@ let
snakeOilCa = pkgs.runCommand "snakeoil-ca" {
buildInputs = [ pkgs.openssl ];
allowSubstitutes = false;
} ''
mkdir "$out"
openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 \
@ -215,6 +216,7 @@ let
'';
in pkgs.runCommand "snakeoil-certs-${fqdn}" {
buildInputs = [ pkgs.openssl ];
allowSubstitutes = false;
} ''
mkdir "$out"
openssl genrsa -out "$out/snakeoil.key" 4096