pyrox.dev / nixpkgs
lol
fork atom

nixos/security.pki: handle PEMs w/o a final newline

According to the ABNF grammar for PEM files described in [RFC
7468][1], an eol character (i.e. a newline) is not mandatory after the
posteb line (i.e. "-----END CERTIFICATE-----" in the case of
certificates).

This commit makes our CA certificate bundler expression account for
the possibility that files in config.security.pki.certificateFiles
might not have final newlines, by using `awk` instead of `cat` to
concatenate them. (`awk` prints a final newline from each input file
even if the file doesn't end with a newline.)

[1]: https://datatracker.ietf.org/doc/html/rfc7468#section-3

Keshav Kini 348858f2 72df572f

options
unified split
Changed files
+4 -9
nixos
modules
security
ca.nix
+4 -9
nixos/modules/security/ca.nix 
···

       
10

       
 

       
    blacklist = cfg.caCertificateBlacklist;


     

       
11

       
 

       
  };


     

       
12

       
 

       



     

       
13

       
-

       
  caCertificates = pkgs.runCommand "ca-certificates.crt"


     

       
14

       
-

       
    { files =


     

       
15

       
-

       
        cfg.certificateFiles ++


     

       
16

       
-

       
        [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];


     

       
17

       
-

       
      preferLocalBuild = true;


     

       
18

       
-

       
     }


     

       
19

       
-

       
    ''


     

       
20

       
-

       
      cat $files > $out


     

       
21

       
-

       
    '';


     

       
22

       
 

       



     

       
23

       
 

       
in


     

       
24

       
 

       



     
···

       
10

       
 

       
    blacklist = cfg.caCertificateBlacklist;


     

       
11

       
 

       
  };


     

       
12

       
 

       



     

       
13

       
+

       
  caCertificates = pkgs.runCommand "ca-certificates.crt" {


     

       
14

       
+

       
    files = cfg.certificateFiles ++ [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];


     

       
15

       
+

       
    preferLocalBuild = true;


     

       
16

       
+

       
  } "awk 1 $files > $out";  # awk ensures a newline between each pair of consecutive files


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
17

       
 

       



     

       
18

       
 

       
in


     

       
19