fetchedMavenDeps: support proxy and custom cacerts#420608
Merged
philiptaron merged 4 commits intoNixOS:masterfrom Jul 1, 2025
Merged
fetchedMavenDeps: support proxy and custom cacerts#420608philiptaron merged 4 commits intoNixOS:masterfrom
philiptaron merged 4 commits intoNixOS:masterfrom
Conversation
This is a fetcher, so impureEnvVars like HTTP_PROXY etc are ok to be propagated into the FOD.
Maven doesn't honor HTTP[S]_PROXY and NO_PROXY env vars out of the box. Instead, it expects the user to configure a settings.xml file. We however impurely pass only these env vars in FODs. This creates the XML file on demand, if one or more env vars is set.
Java doesn't honor NIX_SSL_CERT_FILE out of the box, but instead uses its own concept of a key store. If we see the environment variable being set, we can create a new key store with all certs in that file and pass it to the JVM.
nix-owners
bot
requested review from
Artturin,
Ericson2314,
RossComputerGuy,
alyssais,
emilazy,
philiptaron and
reckenrode
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
Atemu
approved these changes
Jun 27, 2025
Member
Atemu
left a comment
Atemu
left a comment
There was a problem hiding this comment.
The intention is sound IMV and this feels like a good implementation given the constraints.
I had a glance and the diff broadly LGTM too.
nixpkgs-ci
bot
added
the
12.approvals: 1
philiptaron
approved these changes
Jun 30, 2025
Contributor
|
Unfortunately, this PR has broken my ability to build docker images using Broken: Branch including this PR: https://github.com/deftdawg/nixpkgs/tree/openjdk21-CVE-2025-30749 Uneffected: Branch based on commit prior to this PR: https://github.com/deftdawg/nixpkgs/tree/preFetchedMaven-with-JDK-CVE-Fix Being on MacOS, I'm required to build docker containers for validation inside a Docker container ( When I do that on a nixpkgs that contains this PR, the build fails to download files from our artifactory repo (has valid cert trusted by the ca bundle) When It appears as though the buildMavenPackage attempts to import the system's CA certificates (the certificate shown is the first one in the system CA-bundle), however it either fails to do so or fails to apply the change to the JVM parameters... This was discovered validating #432442 verbose output showing certificate import |
Contributor
|
Please open an issue and CC @NixOS/Java. |
3 tasks
13 tasks
Contributor
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-25.05
git worktree add -d .worktree/backport-420608-to-release-25.05 origin/release-25.05
cd .worktree/backport-420608-to-release-25.05
git switch --create backport-420608-to-release-25.05
git cherry-pick -x f8b6b6f512bb579d11be6a9d92ea2565641c4b08 c6d583c3da526f49324d1b34bbad921a2438f9cd 554b465bac817aaacc16add43936efa9bec03068 cd931bff240f5dd9425ab5680bca4357f329820d |
13 tasks
mdaniels5757
added
8.has: port to stable
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, packages using
maven.buildMavenPackagedo not honor impure environment variables likeHTTP[S]_PROXY,NO_PROXYandNIX_SSL_CERT_FILE.We normally propagate these env vars into FODs, so builds running in environments where such proxies are necessary can succeed.
This was not wired up for the maven FOD fetcher, most probably because maven does not honor these environment variables out of the box. Maven requires the user to configure an XML file with proxy settings, and pass a Java Keystore with custom CA certificates imported.
This now happens dynamically at runtime, if the common environment variables are detected.
I tested this (on NixOS) by doing the following:
mitmproxywithout any command line argumentsnix-store --add ~/.mitmproxy/mitmproxy-ca-cert.pemsudo systemctl edit --runtime nix-daemon.service && sudo systemctl restart nix-daemon.service, addingEnvironment=HTTP_PROXY=http://127.0.0.1:8080,Environment=HTTPS_PROXY=http://127.0.0.1:8080andEnvironment=NIX_SSL_CERT_FILE=/nix/store/…-mitmproxy-ca-cert.pemto a new[Service]section./nix/store/…-mitmproxy-ca-cert.pemstore path in thessl-cert-fileandextra-sandbox-pathsagain:nix-build -A openrefine.fetchedMavenDeps --builders '' --check --option extra-sandbox-paths /nix/store/…-mitmproxy-ca-cert.pem.Editing your global
nix.confand settingssl-cert-filemight be another way, YMMV.With this done, I was able to see maven requesting assets through the proxy.
In the future, this tooling might be used to steer Maven to a MITM Caching Proxy, like it's done for Gradle in #272380, but that's left for a followup.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.