nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

download: Fix 'url-fetch/tarbomb' and 'url-fetch/zipbomb'. 

Fixes a regression introduced in 20927c9331.
Reported by Eric Bavier <ericbavier@centurylink.net>.

* guix/download.scm (url-fetch/tarbomb, url-fetch/zipbomb): Within the gexp,
import (guix build utils) for 'invoke'.
master
Mark H Weaver 2018-04-17 01:43:22 -04:00
parent 891199c67d
commit 6c293a809b
No known key found for this signature in database
GPG Key ID: 7CEF29847562C516
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
guix/download.scm
View File

@ -510,12 +510,14 @@ own. This helper makes it easier to deal with \"tar bombs\"."
#:guile guile)))
;; Take the tar bomb, and simply unpack it as a directory.
(gexp->derivation (or name file-name)
#~(begin
(mkdir #$output)
(setenv "PATH" (string-append #$gzip "/bin"))
(chdir #$output)
(invoke (string-append #$tar "/bin/tar")
"xf" #$drv))
(with-imported-modules '((guix build utils))
#~(begin
(use-modules (guix build utils))
(mkdir #$output)
(setenv "PATH" (string-append #$gzip "/bin"))
(chdir #$output)
(invoke (string-append #$tar "/bin/tar")
"xf" #$drv)))
#:local-build? #t)))
(define* (url-fetch/zipbomb url hash-algo hash
@ -540,11 +542,13 @@ own. This helper makes it easier to deal with \"zip bombs\"."
#:guile guile)))
;; Take the zip bomb, and simply unpack it as a directory.
(gexp->derivation (or name file-name)
#~(begin
(mkdir #$output)
(chdir #$output)
(invoke (string-append #$unzip "/bin/unzip")
#$drv))
(with-imported-modules '((guix build utils))
#~(begin
(use-modules (guix build utils))
(mkdir #$output)
(chdir #$output)
(invoke (string-append #$unzip "/bin/unzip")
#$drv)))
#:local-build? #t)))
(define* (download-to-store store url #:optional (name (basename url))