Subject: [bug#69728] Reproducer for the daemon fixed-output derivation vulnerability

From: John Kehayias <[email-masked]>
Date: Tue, 12 Mar 2024 14:35:18 +0000

Hi all,

On Tue, Mar 12, 2024 at 02:45 PM, Ludovic Courtès wrote:

> As promised, attached is a reproducer that I adapted from the Nix one at
> <https://hackmd.io/03UGerewRcy3db44JQoWvw>, which I think was written by
> puck <https://github.com/puckipedia>.
>
> The program demonstrates the vulnerability using two fixed-output
> derivations that must be built concurrently on the same machine.
>

Thanks for the reproducer and instructions. I've included the code an
a brief overview of how to run and what to look for in the updated
post (along with other changes noted privately).

The updated post is attached. I will have some time here and there
over the next few hours to make changes, but will mostly be away from
my Guix machine to handle actually pushing. So, once it looks good,
feel free to do that or I can do it this evening my time (in about 7-8
hours).

Thanks again Ludo’ for all your work here!

John