Don't send plugin-files to the daemon.

[shlevy]

This is radically unsafe and the daemon has already loaded its plugins anyway.

Fixes cachix/devenv#276

[edolstra]

Wouldn't it be better to ignore this setting on the daemon side? Otherwise we're relying on the client not sending it.

[shlevy]

@edolstra Added. I kept both sides, so that newer clients against older daemons wouldn't get the warning either.

@thufschmitt Perhaps my "it was radically unsafe" was misleading. In the status quo, what actually happens is the user gets a confusing warning message, but everything still works, since the attempt to set pluginFiles on the daemon side throws an exception but that exception is caught and swallowed. So this doesn't merit backport for security purposes, though it may be desirable to improve the warning message. The "radical unsafety" would be if this worked.

[github-actions]

Successfully created backport PR for 2.13-maintenance:

• [Backport 2.13-maintenance] Don't send plugin-files to the daemon. #7737

[thufschmitt]

@shlevy that's reassuring :) I thought the daemon would actually load the .so file 😅

Then indeed the backport is probably not warranted, I'll just close the PR