Impact
Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra
user/group.
This should not affect the signing keys, that are owned by the hydra-queue-runner
and hydra-www
users respectively.
Patches
- nix-eval-jobs 2.28.1 allows enabling
restricted-eval
again
- Hydra started configuring nix-eval-jobs for restricted evaluations in commit 8d75026
Workarounds
- Migrate your inputs to flakes, which are evaluated purely
References
Impact
Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the
hydra
user/group.This should not affect the signing keys, that are owned by the
hydra-queue-runner
andhydra-www
users respectively.Patches
restricted-eval
againWorkarounds
References