builtin:fetchurl: Ensure a fixed-output derivation

[edolstra]

Motivation

We accidentally allowed

builtins.derivation {
  name = "nix-cache-info";
  system = "x86_64-linux";
  builder = "builtin:fetchurl";
  url = https://cache.nixos.org/nix-cache-info;
  outputHashMode = "flat";
}

to succeed.

Also clean up the hashed mirror code a bit.

Context

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[thufschmitt]

Ooops 😬

Thanks for the fix

I think the test failure is due to the client not returning the right error code in daemon mode (there's an issue about this somewhere, but I can't find it any more)

[github-actions]

Backport failed for 2.19-maintenance, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin 2.19-maintenance
git worktree add -d .worktree/backport-9902-to-2.19-maintenance origin/2.19-maintenance
cd .worktree/backport-9902-to-2.19-maintenance
git switch --create backport-9902-to-2.19-maintenance
git cherry-pick -x 1ee42c5b88eb0533ebcf8b2579ec82f2be80e4b2 b8b739e484078863c10c48d031fa8459081ba8b3 05535be03a1526061ea3a3ad25459c032e1f8f8c e67458e5b821e0a3a6839f4637eb96ff873f64ed

[github-actions]

Successfully created backport PR for 2.20-maintenance:

• [Backport 2.20-maintenance] builtin:fetchurl: Ensure a fixed-output derivation #9910

[puckipedia]

Hi,

This breaks some of my code. I consider this to be a stable feature. Note that this doesn't actually run builtin:fetchurl inside a FOD, which means that the example given only succeeds if run with sandboxing disabled; one could just use curl, or netcat, or even just bash, to do the same, and i'm not seeing an issue for that problem, seeing as it's inherent to not being in a sandbox.