Follow redirects early to ensure consistency between the manifest and the tarball

Without this change, if the URL is a redirect that changes in between,
we can get a manifest that doesn't match the tarball.

1 files changed, 8 insertions, 0 deletions

diff --git a/scripts/nix-channel.in b/scripts/nix-channel.in
index 283071a9c8b1..b3251975b52b 100755
--- a/scripts/nix-channel.in
+++ b/scripts/nix-channel.in
@@ -88,6 +88,14 @@ sub update {
     my $exprs = "";
     foreach my $name (keys %channels) {
         my $url = $channels{$name};
+
+        # Check if $url is a redirect.  If so, follow it now to ensure
+        # consistency if the redirection is changed between
+        # downloading the manifest and the tarball.
+        my $headers = `$Nix::Config::curl --silent --head '$url'`;
+        die "$0: unable to check `$url'\n" if $? != 0;
+        $headers =~ s/\r//g;
+        $url = $1 if $headers =~ /^Location:\s*(.*)\s*$/m;
         
         # Pull the channel manifest.
         system("$Nix::Config::binDir/nix-pull", "--skip-wrong-store", "$url/MANIFEST") == 0