mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: match the system bundle path with its string context discarded

Browse source
This commit is contained in:
atlas 2026-11-08 18:59:59 +01:00
commit 5af927bfaa
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/module-eval/hive-tls.nix
View file

@ -888,6 +888,9 @@ let
let let
u = units.hive-priv-cache-facts; u = units.hive-priv-cache-facts;
c0re = allLocal.systemd.services.hive-c0re.environment; c0re = allLocal.systemd.services.hive-c0re.environment;
# The system bundle is a store path; `hasInfix` matches by regex, which refuses a string that carries one.
plain = builtins.unsafeDiscardStringContext;
systemBase = plain "base_bundle=${allLocal.security.pki.caBundle}";
in in
lib.hasInfix "!include /run/hyperhive-nix/cache.conf" allLocal.nix.extraOptions lib.hasInfix "!include /run/hyperhive-nix/cache.conf" allLocal.nix.extraOptions
&& !(lib.hasInfix "hyperhive-nix" noIdentity.nix.extraOptions) && !(lib.hasInfix "hyperhive-nix" noIdentity.nix.extraOptions)
@ -907,9 +910,11 @@ let
&& lib.hasInfix "swarm_ca=/var/lib/hive-tls/swarm-services-root.pem" u.script && lib.hasInfix "swarm_ca=/var/lib/hive-tls/swarm-services-root.pem" u.script
&& lib.hasInfix ''atomic_write_secret 0644 "" "$ca_bundle_file"'' u.script && lib.hasInfix ''atomic_write_secret 0644 "" "$ca_bundle_file"'' u.script
# No ssl-cert-file on the host: the system bundle is the base. A host that sets one is merged, not replaced. # No ssl-cert-file on the host: the system bundle is the base. A host that sets one is merged, not replaced.
&& lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" u.script && lib.hasInfix systemBase (plain u.script)
&& lib.hasInfix "base_bundle=/etc/pki/host-ca.pem" noService.systemd.services.hive-priv-cache-facts.script && lib.hasInfix "base_bundle=/etc/pki/host-ca.pem" (
&& !(lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" noService.systemd.services.hive-priv-cache-facts.script) plain noService.systemd.services.hive-priv-cache-facts.script
)
&& !(lib.hasInfix systemBase (plain noService.systemd.services.hive-priv-cache-facts.script))
# No client copy of the token for hive-core, and hive-c0re is not told the cache. # No client copy of the token for hive-core, and hive-c0re is not told the cache.
&& !(lib.hasInfix "client_netrc" u.script) && !(lib.hasInfix "client_netrc" u.script)
&& !(c0re ? HIVE_C0RE_CACHE_URL) && !(c0re ? HIVE_C0RE_CACHE_URL)