Nix Release 2.25.0 - TLS Verification for fetchurl.nix and Contributors

Previously `<nix/fetchurl.nix>` did not do TLS verification. This was because the Nix sandbox in the past did not have access to TLS certificates, and Nix checks the hash of the fetched file anyway. However, this can expose authentication data from `netrc` and URLs to man-in-the-middle attackers. In addition, Nix now in some cases (such as when using impure derivations) does *not* check the hash. Therefore we have now enabled TLS verification. This means that downloads by `<nix/fetchurl.nix>` will now fail if you're fetching from a HTTPS server that does not have a valid certificate. `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. # Contributors This release was made possible by the following 58 contributors: - 1444 [**(@0x5a4)**](https://github.com/0x5a4) - Adrian Hesketh [**(@a-h)**](https://github.com/a-h) - Aleksana [**(@Aleksanaa)**](https://github.com/Aleksanaa) - Alyssa Ross [**(@alyssais)**](https://github.com/alyssais) - Andrew Marshall [**(@amarshall)**](https://github.com/amarshall) - Artemis Tosini [**(@artemist)**](https://github.com/artemist) - Artturin [**(@Artturin)**](https://github.com/Artturin) - Bjørn Forsman [**(@bjornfor)**](https://github.com/bjornfor) - Brian McGee [**(@brianmcgee)**](https://github.com/brianmcgee) - Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh) - Bryan Honof [**(@bryanhonof)**](https://github.com/bryanhonof) - Cole Helbling [**(@cole-h)**](https://github.com/cole-h) - Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra) - Eman Resu [**(@llakala)**](https://github.com/llakala) - Emery Hemingway [**(@ehmry)**](https://github.com/ehmry) - Emil Petersen [**(@leetemil)**](https://github.com/leetemil) - Emily [**(@emilazy)**](https://github.com/emilazy) - Geoffrey Thomas [**(@geofft)**](https://github.com/geofft) - Gerg-L [**(@Gerg-L)**](https://github.com/Gerg-L) - Ivan Tkachev - Jacek Galowicz [**(@tfc)**](https://github.com/tfc) - Jan Hrcek [**(@jhrcek)**](https://github.com/jhrcek) - Jason Yundt [**(@Jayman2000)**](https://github.com/Jayman2000) - Jeremy Kerfs [**(@jkerfs)**](https://github.com/jkerfs) - Jeremy Kolb [**(@kjeremy)**](https://github.com/kjeremy)

This section discusses the enabling of TLS verification for `<nix/fetchurl.nix>` in Nix Release 2.25.0 to mitigate man-in-the-middle attacks. It clarifies that this change affects the builtin derivation builder `builtin:fetchurl` but not the evaluation-time function `builtins.fetchurl`. The section also lists the 58 contributors who made the release possible.