From 0c7c1660f78e4f6befe0a210e1a9efae783a1733 Mon Sep 17 00:00:00 2001 From: aszlig Date: Sat, 30 Jun 2018 18:31:38 +0200 Subject: nixos/tests/letsencrypt: Don't substitute certs If one of the certificates of the chain gets substituted from a binary cache and the rest is generated locally it might turn out that we get invalid certificates, which in turn cause tests using this module to fail. So let's set allowSubstitutes to false for all derivations that are involved with certificate/key generation. Signed-off-by: aszlig --- nixos/tests/common/letsencrypt.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'nixos/tests/common') diff --git a/nixos/tests/common/letsencrypt.nix b/nixos/tests/common/letsencrypt.nix index 7c6b3b29e36..2c86fe8d68b 100644 --- a/nixos/tests/common/letsencrypt.nix +++ b/nixos/tests/common/letsencrypt.nix @@ -193,6 +193,7 @@ let snakeOilCa = pkgs.runCommand "snakeoil-ca" { buildInputs = [ pkgs.openssl ]; + allowSubstitutes = false; } '' mkdir "$out" openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 \ @@ -215,6 +216,7 @@ let ''; in pkgs.runCommand "snakeoil-certs-${fqdn}" { buildInputs = [ pkgs.openssl ]; + allowSubstitutes = false; } '' mkdir "$out" openssl genrsa -out "$out/snakeoil.key" 4096 -- cgit 1.4.1