Ludovic Courtès 48cdb840ac channels: Do not compute cache key from channel name [security fix]. ...

Previously the cache key would be computed by prepending “channels/” to the
channel name.  Thus, a channel defined like this:

  (channel (name (symbol->string "../../../../PWND")) …)

… would lead to the creation of a file in $HOME.

This attack is accessible even with channel files evaluated in a sandbox, and
even if the channel is otherwise marked as trusted.

This change fixes that.

* guix/git-authenticate.scm (repository-cache-key): Deprecate.
(authenticate-repository): Change default value of #:cache-key.
(authenticated-commit-cache-file): Replace dots in KEY with dashes.
* guix/scripts/git/authenticate.scm (guix-git-authenticate): Use ‘commit’ as
the default value of ‘cache-key’.
* guix/channels.scm (maybe-link-old-cache): New procedure.
(authenticate-channel): Remove ‘cache-key’ and #:cache-key argument to
‘authenticate-repository’.  Call ‘maybe-link-old-cache’.

Reported-by: Sergio Pastor Pérez <sergio.pastor-perez@inria.fr>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

2026-07-02 19:42:48 +02:00

..

authenticate.scm

channels: Do not compute cache key from channel name [security fix].

2026-07-02 19:42:48 +02:00