Yeah if the url is https://i_hack.you/ yeah that will be easy to spot. But imagine an attacker just to a “patch update”, updating the url and hash to the malicious repository, and use a typo squatted domain/repository, that will make it harder to spot.
Yeah if the url is https://i_hack.you/ yeah that will be easy to spot. But imagine an attacker just to a “patch update”, updating the url and hash to the malicious repository, and use a typo squatted domain/repository, that will make it harder to spot.
No, it would actually be quite easy to spot.
Nixpkgs templates the source code url fro the url, and then it injects a variable
Here is an example from bash:
pname = "bash${lib.optionalString interactive "-interactive"}"; version = "5.3${fa.patch_suffix}"; patch_suffix = "p${toString (builtins.length upstreamPatches)}"; src = fetchurl { url = "mirror://gnu/bash/bash-$%7Blib.removeSuffix fa.patch_suffix fa.version}.tar.gz"; hash = "sha256-DVzYaWX4aaJs9k9Lcb57lvkKO6iz104n6OnZ1VUPMbo="; };If the url were to be changed, it would show up as a change in git when someone is reviewing before merging.