Backport Lix CVE fixes to Nix 2.3#5

Open

tazjin wants to merge 9 commits into

2.3-maintenancefrom

Commits on Jun 29, 2025

libutil: guess or invent a path from file descriptors

Raito Bezarius
authored and
tazjin
committed
libstore: open build directory as a dirfd as well

Raito Bezarius
authored and
tazjin
committed
libstore: chown to builder variant for file descriptors

Raito Bezarius
authored and
tazjin
committed
Improve durability of schema version file writes

squalus
authored and
tazjin
committed
libutil: writeFile variant for file descriptors

Raito Bezarius
authored and
tazjin
committed
libstore: ensure that `passAsFile` is created in the original tmpdir

Raito Bezarius
authored and
tazjin
committed
Fix long paths permanently breaking GC

alyssais
authored and
tazjin
committed
deletePath(): Return ENFILE instead of EBADF when out of file descriptors

edolstra
authored and
tazjin
committed
libutil: ensure that `_deletePath` does NOT use absolute paths with dirfds

Raito Bezarius
authored and
tazjin
committed