Possibility of leak of infinixbot personal access token

An unprivileged user could exfiltrate a GitHub personal access token (PAT) by creating a malicious PR. The PAT is for the unprivileged @infinixbot machine user, so the consequence of such a leak would be pretty minor (and looking at past PRs, we're pretty sure it was never leaked).

Root cause:

1. A PAT (for the @infinixbot user) gets written to disk here:

   • nixfmt/scripts/sync-pr.sh

     Line 55 in 012f43a

     git -C nixfmt fetch "$nixfmtUrl" "refs/pull/$nixfmtPrNumber/merge"

     (potentially)

   • nixfmt/scripts/sync-pr.sh

     Line 104 in 012f43a

     git -C nixpkgs.git remote add upstream "$nixpkgsUpstreamUrl"

     (definitely)
2. We evaluate a trusted nix file (sync-pr-support.nix), but pass it an untrusted directory (nixfmtPath) here:

   nixfmt/scripts/sync-pr.sh

   Line 273 in 012f43a

   if ! nix-build "$SCRIPT_DIR/sync-pr-support.nix" -A formattedGitRepo --arg storePath "$baseStorePath" --arg nixfmtPath "$PWD/nixfmt"; then

3. sync-pr-support.nix imports and (impurely) evaluates the untrusted nixfmtPath here:

   nixfmt/scripts/sync-pr-support.nix

   Line 27 in 012f43a

   nixfmt = (import nixfmtPath { }).packages.nixfmt;

4. The untrusted nix file could read secrets using builtins.readFile and extract them via builtins.fetchurl or fetchTarball.

This has been addressed by refactoring sync-pr-support.nix and the relevant orchestration in sync-pr.sh to run the untusted code within a separate pure eval (using flakes). The resulting outPath is then passed to sync-pr-support.nix to run the untrusted executable within a nix sandbox (as before). See #423.

Out of an abundance of caution, we rotated the PAT after the vulnerability was patched.