Maybe I understand incorrectly, but how would a NIX_OTHER_STORE be less secure than for example a channel you've registered to?
Michael Raskin wrote: > Marc Weber wrote: >> I'm not sure I've understood how this works: > >> So can I copy some dirs from /nix/store to my home directory, >> modify them, change their hash to a hash which is very likely to be >> installed by the system anyway later on (due to updates or such) >> and ask the system to install that *update* which is indeed malware? > > All env-vars are checked by process doing the build. It is nix-store > with root rights or nix-worker.. It is not a protocol change (which > would need some security) - it is a change requiring store write access > to use. _______________________________________________ nix-dev mailing list [email protected] https://mail.cs.uu.nl/mailman/listinfo/nix-dev _______________________________________________ nix-dev mailing list [email protected] https://mail.cs.uu.nl/mailman/listinfo/nix-dev
