hydra

Recent security vulnrabilities in Hydra - github.com/NixOS/hydra/security/advisories/GHSA-r… - github.com/NixOS/hydra/security/advisories/GHSA-2… were disclosed today, with the migrations merged in - Hydra: github.com/NixOS/hydra/commit/12053f31df077f9d1bb… - Lix's Hydra: git.lix.systems - Hydra in Nixpkgs bumped in nixpkgs#582719. hydra.nixos.org was already hardened via a proxy server configuration change. A Lix deployment (I do not know what URL) was likewise already hardened. The CUDA team's deployment at hydra.nixos-cuda.org was also hardened. This would be done by limiting the log endpoint to disallow .. as a "store path". Example nginx: @hydra_log_dot vars_regexp {http.request.uri.path} ^/log/\.|(^|/)\.\.?(/|$) handle @hydra_log_dot { respond } Hydra deployers should update and/or likewise update their proxy server configurations. Thank you to github.com/lesuisse for reporting the issues (I do not know Discourse handle), and for @ma27 and @glepage for joining me on call today to release everyone synchronously. Happy integrating continuously, everyone!