Security Advisory: `darwin.linux-builder` leaks its SSH private key into the Nix store and exposes its SSH port to the network
A security vulnerability in NixOS's macOS Linux builder exposes SSH private keys in the Nix store and opens SSH ports to the network, potentially allowing unauthorized access to build environments.
The vulnerability affects multiple NixOS components including darwin.linux-builder, darwin.linux-builder-x86_64, darwin.linux-builder-vz, and nix-darwin's nix.linux-builder. These flaws allow other users to gain trusted access to the builder virtual machine and potentially poison build results returned to the host system.
The first issue (GHSA-45qr-47fw-2p57) occurs when the run-builder script incorrectly imports the entire keys directory into the Nix store using nix-store --add, exposing the builder_ed25519 private key. Simultaneously, the builder's SSH port is exposed to the network, creating a dual security risk.
NixOS developers have identified the vulnerability and are working on patches. Users should monitor official channels for updates and consider implementing additional security measures until fixes are deployed.
