security/pki: handle certificate paths with spaces

LnL7 · Aug 16, 2024 · 44863a0 · 44863a0
1 parent 91010a5
commit 44863a0
Showing 1 changed file with 5 additions and 6 deletions.
diff --git a/modules/security/pki/default.nix b/modules/security/pki/default.nix
@@ -9,13 +9,12 @@ let
     blacklist = cfg.caCertificateBlacklist;
   };
 
-  caCertificates = pkgs.runCommand "ca-certificates.crt"
-    { files =
-        cfg.certificateFiles ++
-        [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];
-     }
+  caCertificates = pkgs.runCommand "ca-certificates.crt" {}
     ''
-      cat $files > $out
+      cat ${escapeShellArgs (
+        cfg.certificateFiles ++
+        [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ]
+      )} > $out
     '';
 in