* computeStorePathForText: take the references into account when

  computing the store path (NIX-77).  This is an important security
  property in multi-user Nix stores.

  Note that this changes the store paths of derivations (since the
  derivation aterms are added using addTextToStore), but not most
  outputs (unless they use builtins.toFile).

1 files changed, 1 insertions, 1 deletions

diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index aea95ef31477..3456a5f714a0 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -29,7 +29,7 @@ Path writeDerivation(const Derivation & drv, const string & name)
     string suffix = name + drvExtension;
     string contents = atPrint(unparseDerivation(drv));
     return readOnlyMode
-        ? computeStorePathForText(suffix, contents)
+        ? computeStorePathForText(suffix, contents, references)
         : store->addTextToStore(suffix, contents, references);
 }