fix(core): use current user when hashing native file & enable setting its directory via env

[MaxKless]

Current Behavior

The native file hashing takes only the nx version & workspace path into account.
There is also no way to control the storage location of native .node files used by nx.

Expected Behavior

The native file hashing takes the nx version, workspace path & current username into account, making sure the cache isn't shared between multiple users on the same device.
It's also possible to control the exact location of the native file cache by setting the NX_NATIVE_FILE_CACHE_DIRECTORY environment variable if you need to move it somewhere else.

Related Issue(s)

Fixes #

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Updated (UTC)
nx-dev	⬜️ Ignored (Inspect)	Visit Preview	May 23, 2024 6:15pm

[nx-cloud]

☁️ Nx Cloud Report

CI is running/has finished running commands for commit 93ecc01. As they complete they will appear below. Click to see the status, the terminal output, and the build insights.

📂 See all runs for this CI Pipeline Execution

---

✅ Successfully ran 6 targets

• nx affected --targets=e2e,e2e-ci --base=89fdd42c803e5cdfc95a89920f885da61ac21ebf --head=93ecc0144ad00b9e0de4af92974f20d7536ef2c3 --parallel=1
• nx affected --targets=lint,test,build --base=89fdd42c803e5cdfc95a89920f885da61ac21ebf --head=93ecc0144ad00b9e0de4af92974f20d7536ef2c3 --parallel=3
• nx run-many -t check-imports check-commit check-lock-files check-codeowners documentation --parallel=1 --no-dte
• nx-cloud record -- nx format:check --base=89fdd42c803e5cdfc95a89920f885da61ac21ebf --head=93ecc0144ad00b9e0de4af92974f20d7536ef2c3
• nx documentation --no-dte
• nx affected -t e2e-macos-ci --parallel=1 --base=89fdd42c803e5cdfc95a89920f885da61ac21ebf --head=93ecc0144ad00b9e0de4af92974f20d7536ef2c3

---

Sent with 💌 from NxCloud.

[FrozenPandaz]

Do we need a shortUserHash here as well as in the hash for the child directory?

right now we have...

/tmp/[F(username)]/[F(username, workspaceRoot]

We should be able to have..

/tmp/[F(username, workspaceRoot)] right?

outdated

[Ten0]

because the hash is deterministic and tmp is world-writable and regularly cleaned up, if the client assumes that the node binary is correct, isn't that a security issue?
Another user could place a trojaned binary in the path that this user would use as a cache hit, no?
(This is the attack scenario I described at #23904 (comment))

[MaxKless]

if you're worried about other users on your system, you can set the location to a folder only you have access to via the new environment variable

[Ten0]

It looks like alternately this could be stored in ~/.cache.

I have this as a transitive dependency that I didn't particularly ask for.

Expecting from all users that they realize that they have this dependency, inspect all of its inner workings to realize there is a security issue, and finally set an env variable to mitigate it does not seem like a sound way to handle security issues.

[MaxKless]

That's a valid point. I'm hesitant to set the directory to something user-scoped because of potentially different permission handling across OS. My biggest priority is avoiding errors when using Nx because copying that file is required and if there is a permission issue, we could cause errors for everyone - not just those with hypothetical malicious other users on the same machine.
For now the environment variable is the way to go but I see your point and will reconsider this.

[github-actions]

This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request.