From cb4dcba4091e3258dea6dc27b681b17481990e5b Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Tue, 24 Mar 2026 12:58:11 -0700
Subject: [PATCH] nixos/ec2-metadata-fetcher: harden try_decompress

- Declare `ftype` as local to avoid leaking into caller scope
- Skip decompression attempt on empty files
- Clean up temp file on decompression failure
---
 .../modules/virtualisation/ec2-metadata-fetcher.sh  | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
index a34b9c2d6f6e..dcdd99ca6b38 100644
--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
@@ -62,14 +62,21 @@ get_imds() {
 }
 
 try_decompress() {
-  local temp
+  local temp ftype
+  if [ ! -s "$1" ]; then
+    return
+  fi
   ftype=$(file --brief "$1")
   case $ftype in
     gzip*)
       echo "decompressing: $1"
       temp=$(mktemp)
-      zcat "$1" > "$temp"
-      mv "$temp" "$1"
+      if zcat "$1" > "$temp"; then
+        mv "$temp" "$1"
+      else
+        echo "failed to decompress: $1"
+        rm -f "$temp"
+      fi
   esac
 }