Nix-build curl issues behind proxy

Help
1

I think I’m having some issues with curl on NixOS behind a corporate proxy. curl on my shell works fine, but fetching things through Nix during a build doesn’t. For example, nix-build-ing a package that simply uses fetchzip to pull https://ftp.gnu.org/gnu/hello/hello-2.12.1.tar.gz results in the error below, even though curl https://ftp.gnu.org/gnu/hello/hello-2.12.1.tar.gz succeeds my shell.

> nix-build
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
  /nix/store/8n9l4kbrbjgn8b6f1j0aksi180zyfbgk-source.drv
building '/nix/store/8n9l4kbrbjgn8b6f1j0aksi180zyfbgk-source.drv'...
error checking the existence of https://tarballs.nixos.org/sha256/:
curl: (60) SSL certificate problem: self-signed certificate in certificate chain
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

trying https://ftp.gnu.org/gnu/hello/hello-2.12.1.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) SSL certificate problem: self-signed certificate in certificate chain
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
error: cannot download source from any mirror
error: boost::bad_format_string: format-string is ill-formed

Why does nix-build act differently, how do I configure it correctly, and also where is this documented?

The same issue does not appear without a proxy. Details on my setup:

  • I have a bunch of our company-internal SSL certificates stored in my configuration.nix in security.pki.certificates.
  • I am running cntlm on localhost:3128 which successfully connects to our company proxy
  • I set networking.proxy.default and networking.proxy.noProxy accordingly in my configuration.nix, and other apps - such as Firefox - are working fine
2

Turns out, SSL certificate handling by Nix fetchers is a big mess. While I can perfectly do this:

> nix-shell --pure -p curl
[nix-shell]$ export CURL_CA_BUNDLE=/etc/ssl/certs/ca-bundle.crt
[nix-shell]$ curl -I https://ftp.gnu.org/gnu/hello/hello-2.12.1.tar.gz

there is no obvious way of achieving the same when using fetchers such as fetchzip. A (bad) workaround is passing curlOpts = "--insecure" to fetchzip or fetchurl see code.

An alternative is to use fetchTarball which doesn’t seem to care about SSL verification, so that works (but of course I only control the fetchers in my own Nix code).

3

I haven’t checked, but possibly NIX_SSL_CERT_FILE could work

(I think the reasoning here is that you’d pass a sha256 to fetchTarball, so even if the certificate can’t be verified you can be sure the artifact was intact because its hash is checked)

4

You also pass sha256 to fetchzip or fetchurl, it’s curl that by default cares about SSL verification. Regarding NIX_SSL_CERT_FILE, as I understand it this would have to be part of the nix-daemon service’s Environment in order to be visible by builds created from it. I can confirm it doesn’t work either, same outcome as before.

5
1 Like