From d1fd8055b1ead8e1f0e9b31d98998deb02032eff Mon Sep 17 00:00:00 2001 From: Adam Chrapkowski Date: Tue, 27 Oct 2026 18:45:19 +0000 Subject: [PATCH 1/2] Run under /bin/sh, accept `scip-rust index`, distrust eMudhra roots - Add BusyBox to the image so /bin/sh exists for callers that run commands in the container through a shell. Its wget and ssl_client applets are disabled because BusyBox does not verify TLS certificates. - scip-rust: drop a leading `index` argument. Releases up to v0.0.5 ignored their arguments and callers still run `scip-rust index`; rust-analyzer treated `index` as the project path and wrote an empty index. A directory named `index` can still be indexed as `./index`. - Distrust the emSign ECC Root CA - G3 and Comodo AAA Services roots in the image's CA bundle after the eMudhra intermediate CA key compromise (https://emudhra.we-have-a-problem.com/). nixos-26.05 still ships cacert 3.126; drop the override once it has 3.131.1 or later. --- flake.nix | 25 +++++++++++++++++++++++-- scip-rust | 8 ++++++++ 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index ba2fe1c..1371847 100644 --- a/flake.nix +++ b/flake.nix @@ -23,6 +23,26 @@ }; text = builtins.readFile ./scip-rust; }; + # Distrust the roots behind the compromised eMudhra intermediate CAs + # (https://emudhra.we-have-a-problem.com/). Drop once nixpkgs ships + # cacert 3.131.1 or later. + dockerTools = pkgs.dockerTools.override { + cacert = pkgs.cacert.override { + blacklist = [ + "Comodo AAA Services root" + "emSign ECC Root CA - G3" + ]; + }; + }; + # Provides /bin/sh for callers that run commands in the container + # through a shell. wget and ssl_client are left out: BusyBox does + # not verify TLS certificates. + busybox = pkgs.busybox.override { + extraConfig = '' + CONFIG_WGET n + CONFIG_SSL_CLIENT n + ''; + }; in { packages = { @@ -30,12 +50,13 @@ default = scip-rust; } // pkgs.lib.optionalAttrs pkgs.stdenv.isLinux { - docker = pkgs.dockerTools.buildLayeredImage { + docker = dockerTools.buildLayeredImage { name = "scip-rust"; tag = "latest"; contents = [ scip-rust - pkgs.dockerTools.caCertificates + busybox + dockerTools.caCertificates pkgs.git ]; fakeRootCommands = "mkdir -p /work /tmp"; diff --git a/scip-rust b/scip-rust index b213f50..1394f85 100755 --- a/scip-rust +++ b/scip-rust @@ -22,6 +22,14 @@ for tool in cargo rust-analyzer rustc; do fi done +# Drop a leading `index` argument. Releases up to v0.0.5 ignored their +# arguments, and existing callers (such as auto-indexing jobs) still run +# `scip-rust index`; without this, rust-analyzer would treat `index` as the +# project path. To index a directory named `index`, pass `./index`. +if [ "${1:-}" = "index" ]; then + shift +fi + # Forward any extra args (e.g. `--output PATH`) to rust-analyzer; default # to indexing the current directory if no path is given. if [ $# -eq 0 ]; then From f600d58c28cfb1ac4cc7007a028d786328b77dd7 Mon Sep 17 00:00:00 2001 From: Adam Chrapkowski Date: Tue, 27 Oct 2026 20:46:55 +0000 Subject: [PATCH 2/2] Test the /bin/sh path in CI and correct the cacert comment - ci: in the docker job, also index through `--entrypoint /bin/sh` with `scip-rust index`, and check that the image has no BusyBox wget or ssl_client. - flake: the pinned cacert is 3.123 and already distrusts Comodo AAA Services root for TLS. cacert 3.131.1 drops emSign ECC Root CA - G3, so the override fails the build after a nixpkgs bump to it. --- .github/workflows/ci.yaml | 20 ++++++++++++++++++++ flake.nix | 7 +++++-- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 81b747b..1b25999 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -52,6 +52,26 @@ jobs: echo "Index size: $size bytes" [ "$size" -ge 102400 ] || { echo "FAIL: index too small"; exit 1; } + # Callers that run commands through /bin/sh and still pass the `index` + # argument accepted by releases up to v0.0.5. + - name: Index target via /bin/sh and `scip-rust index` + run: | + rm target/index.scip + docker run --rm --entrypoint /bin/sh -v "$PWD/target:/work" \ + scip-rust:latest -c 'scip-rust index' + + - name: Check index size + run: | + size=$(stat --format='%s' target/index.scip) + echo "Index size: $size bytes" + [ "$size" -ge 102400 ] || { echo "FAIL: index too small"; exit 1; } + + # BusyBox wget and ssl_client do not verify TLS certificates. + - name: Check the image has no BusyBox TLS clients + run: | + docker run --rm --entrypoint /bin/sh scip-rust:latest \ + -c '! command -v wget && ! command -v ssl_client' + index: strategy: fail-fast: false diff --git a/flake.nix b/flake.nix index 1371847..ecac3e8 100644 --- a/flake.nix +++ b/flake.nix @@ -24,8 +24,11 @@ text = builtins.readFile ./scip-rust; }; # Distrust the roots behind the compromised eMudhra intermediate CAs - # (https://emudhra.we-have-a-problem.com/). Drop once nixpkgs ships - # cacert 3.131.1 or later. + # (https://emudhra.we-have-a-problem.com/). The pinned cacert (3.123) + # already distrusts Comodo AAA Services root for TLS; it is listed as + # defence in depth. cacert 3.131.1 drops emSign ECC Root CA - G3, so + # this override fails the build after a nixpkgs bump to it; remove it + # then. dockerTools = pkgs.dockerTools.override { cacert = pkgs.cacert.override { blacklist = [