about summary refs log tree commit diff
path: root/tvix/store
diff options
context:
space:
mode:
authorFlorian Klink <flokli@flokli.de>2023-08-19T20·01+0200
committerflokli <flokli@flokli.de>2023-08-20T22·19+0000
commit0193f07642db752c3e14e02064c02b0fd1cc060b (patch)
tree85130551dd210f650bc66b4a1dc2d612bbaa5e0c /tvix/store
parent4017039595fc85c02c8c313b73073220954b9f5a (diff)
refactor(tvix/nix-compat/nixhash): validate digest lengths r/6512
There was a NixHash::new() before, which didn't perform any validation
of the digest length. We had some length validation when parsing nix
hashes or SRI hashes, but some places didn't perform validation and/or
constructed the struct directly.

Replace NixHash::new() with a
`impl TryFrom<(HashAlgo, Vec<u8>)> for NixHash`,  which does do this
validation, and update constructing code to use that, rather than
populating structs directly. In some rare cases where we're sure the
digest length is correct we still populate the struct manually.

Fixes b/291.

Change-Id: I7a323c5b18d94de0ec15e391b3e7586df42f4229
Reviewed-on: https://cl.tvl.fyi/c/depot/+/9109
Reviewed-by: raitobezarius <tvl@lahfa.xyz>
Autosubmit: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI
Diffstat (limited to 'tvix/store')
-rw-r--r--tvix/store/src/store_io.rs17
1 files changed, 12 insertions, 5 deletions
diff --git a/tvix/store/src/store_io.rs b/tvix/store/src/store_io.rs
index 1030bbdd337f..615d1f50f4a3 100644
--- a/tvix/store/src/store_io.rs
+++ b/tvix/store/src/store_io.rs
@@ -114,9 +114,12 @@ impl TvixStoreIO {
         )
         .expect("error during nar calculation"); // TODO: handle error
 
-        // For given NAR sha256 digest and name, return the new [StorePath] this would have.
-        let nar_hash_with_mode =
-            NixHashWithMode::Recursive(NixHash::new(HashAlgo::Sha256, nar_sha256.to_vec()));
+        // We populate the struct directly, as we know the sha256 digest has the
+        // right size.
+        let nar_hash_with_mode = NixHashWithMode::Recursive(NixHash {
+            algo: HashAlgo::Sha256,
+            digest: nar_sha256.to_vec(),
+        });
 
         let name = path
             .file_name()
@@ -172,8 +175,12 @@ impl TvixStoreIO {
 /// For given NAR sha256 digest and name, return the new [StorePath] this would have.
 #[instrument(skip(nar_sha256_digest), ret, fields(nar_sha256_digest=BASE64.encode(nar_sha256_digest)))]
 fn calculate_nar_based_store_path(nar_sha256_digest: &[u8; 32], name: &str) -> StorePath {
-    let nar_hash_with_mode =
-        NixHashWithMode::Recursive(NixHash::new(HashAlgo::Sha256, nar_sha256_digest.to_vec()));
+    // We populate the struct directly, as we know the sha256 digest has the
+    // right size.
+    let nar_hash_with_mode = NixHashWithMode::Recursive(NixHash {
+        algo: HashAlgo::Sha256,
+        digest: nar_sha256_digest.to_vec(),
+    });
 
     build_regular_ca_path(name, &nar_hash_with_mode, Vec::<String>::new(), false).unwrap()
 }