fix(users/Profpatsch/arglib): remove env var after read r/2204

arglib should remove its arguments after reading it, to prevent them
from leaking to any child processes.

Change-Id: Ifc107b1620b8e407bad6b3d0ad7f4728856ec2ba
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2501
Tested-by: BuildkiteCI
Reviewed-by: Profpatsch <mail@profpatsch.de>

1 files changed, 4 insertions, 2 deletions

diff --git a/users/Profpatsch/arglib/default.nix b/users/Profpatsch/arglib/default.nix
index 4da2e196db9c..b263654ac3e0 100644
--- a/users/Profpatsch/arglib/default.nix
+++ b/users/Profpatsch/arglib/default.nix
@@ -20,7 +20,7 @@ let
               None => std::ffi::OsStr::from_bytes("ARGLIB_NETENCODE".as_bytes()),
               Some(a) => a
           };
-          match std::env::var_os(env) {
+          let t = match std::env::var_os(env) {
               None => exec_helpers::die_user_error(prog_name, format!("could not read args, envvar {} not set", env.to_string_lossy())),
               // TODO: good error handling for the different parser errors
               Some(soup) => match netencode::parse::t_t(soup.as_bytes()) {
@@ -30,7 +30,9 @@ let
                   },
                   Err(err) => exec_helpers::die_environment_problem(prog_name, format!("arglib parsing error: {:?}", err))
               }
-          }
+          };
+          std::env::remove_var(env);
+          t
       }
     '';
   };