git.iko.soy/typeable/nixpkgs
on master help sign in
signal-desktop: Fix the database encryption by preloading SQLCipher

AFAIK this is the only reliable way for us to ensure SQLCipher will be loaded instead of SQLite. It feels like a hack/workaround but according to the SQLCipher developers [0] "this issue can and should be handled downstream at the application level: 1. While it may feel like a workaround, using LD_PRELOAD is a legitimate approach here because it will substitute the system SQLite with SQLCipher which is the intended usage model;". This fixes #108772 for NixOS 20.09 users who upgrade to NixOS 21.05 and replaces #117555. For nixos-unstable users this will unfortunately break everything again so we should add a script to ease the transition (in a separate commit so that we can revert it for NixOS 21.05). [0]: https://github.com/sqlcipher/sqlcipher/issues/385#issuecomment-802874340

commit940dfa99401c04c78bc530c72ecba6f6ccee62e8 authorMichael Weiss <dev.primeos@gmail.com> dateFri 14 May 2021, 02:23 (6 years ago) parent1cdf5f4
2 files changed+10−5
nixos/tests/signal-desktop.nix+4−5 pkgs/applications/networking/instant-messengers/signal-desktop/default.nix+6
nixos/tests/signal-desktop.nix+4−5
@@ -44,12 +44,11 @@ import ./make-test-python.nix ({ pkgs, ...} :
4444 # - https://github.com/NixOS/nixpkgs/issues/108772
4545 # - https://github.com/NixOS/nixpkgs/pull/117555
4646 print(machine.succeed("su - alice -c 'file ~/.config/Signal/sql/db.sqlite'"))
47− # TODO: The DB should be encrypted and the following should be machine.fail
48− # instead of machine.succeed but the DB is currently unencrypted and we
49− # want to notice if this isn't the case anymore as the transition to a
50− # encrypted DB can cause data loss!:
5147 machine.succeed(
52− "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -i sqlite"
48+ "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep 'db.sqlite: data'"
49+ )
50+ machine.fail(
51+ "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -e SQLite -e database"
5352 )
5453 '';
5554})
pkgs/applications/networking/instant-messengers/signal-desktop/default.nix+6
@@ -117,9 +117,15 @@ in stdenv.mkDerivation rec {
117117 runHook postInstall
118118 '';
119119
120+ # Required for $SQLCIPHER_LIB which contains "/build/" inside the path:
121+ noAuditTmpdir = true;
122+
120123 preFixup = ''
124+ export SQLCIPHER_LIB="$out/lib/Signal/resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
125+ test -x "$SQLCIPHER_LIB" # To ensure the location hasn't changed
121126 gappsWrapperArgs+=(
122127 --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
128+ --prefix LD_PRELOAD : "$SQLCIPHER_LIB"
123129 ${customLanguageWrapperArgs}
124130 )
125131