2003-07-20 21:29:38 +02:00
|
|
|
%: %.in Makefile
|
|
|
|
|
sed \
|
2012-01-11 17:58:49 +01:00
|
|
|
-e "s^@abs_top_srcdir\@^$(abs_top_srcdir)^g" \
|
|
|
|
|
-e "s^@abs_top_builddir\@^$(abs_top_builddir)^g" \
|
2004-05-04 19:04:17 +02:00
|
|
|
-e "s^@extra1\@^$(extra1)^g" \
|
2003-11-22 19:45:56 +01:00
|
|
|
-e "s^@prefix\@^$(prefix)^g" \
|
|
|
|
|
-e "s^@bindir\@^$(bindir)^g" \
|
2012-03-19 01:20:02 +01:00
|
|
|
-e "s^@datadir\@^$(datadir)^g" \
|
2003-11-22 19:45:56 +01:00
|
|
|
-e "s^@sysconfdir\@^$(sysconfdir)^g" \
|
2013-01-02 23:52:15 +01:00
|
|
|
-e "s^@profiledir\@^$(profiledir)^g" \
|
2003-11-22 19:45:56 +01:00
|
|
|
-e "s^@localstatedir\@^$(localstatedir)^g" \
|
|
|
|
|
-e "s^@datadir\@^$(datadir)^g" \
|
2011-10-10 23:11:08 +02:00
|
|
|
-e "s^@libdir\@^$(libdir)^g" \
|
2003-12-23 23:15:12 +01:00
|
|
|
-e "s^@libexecdir\@^$(libexecdir)^g" \
|
2004-02-20 12:32:30 +01:00
|
|
|
-e "s^@storedir\@^$(storedir)^g" \
|
2003-12-01 15:36:50 +01:00
|
|
|
-e "s^@system\@^$(system)^g" \
|
2008-04-10 11:54:23 +02:00
|
|
|
-e "s^@shell\@^$(bash)^g" \
|
2004-04-06 10:18:51 +02:00
|
|
|
-e "s^@curl\@^$(curl)^g" \
|
2012-03-18 23:54:57 +01:00
|
|
|
-e "s^@bzip2\@^$(bzip2)^g" \
|
2012-06-29 20:26:31 +02:00
|
|
|
-e "s^@xz\@^$(xz)^g" \
|
2004-03-15 16:23:53 +01:00
|
|
|
-e "s^@perl\@^$(perl)^g" \
|
2011-04-11 12:13:53 +02:00
|
|
|
-e "s^@perlFlags\@^$(perlFlags)^g" \
|
2005-03-15 13:03:15 +01:00
|
|
|
-e "s^@coreutils\@^$(coreutils)^g" \
|
2010-03-05 19:26:47 +01:00
|
|
|
-e "s^@sed\@^$(sed)^g" \
|
2005-03-15 13:03:15 +01:00
|
|
|
-e "s^@tar\@^$(tar)^g" \
|
2012-08-01 22:42:51 +02:00
|
|
|
-e "s^@tarFlags\@^$(tarFlags)^g" \
|
2008-05-07 16:18:28 +02:00
|
|
|
-e "s^@gzip\@^$(gzip)^g" \
|
2012-04-13 14:41:33 +02:00
|
|
|
-e "s^@pv\@^$(pv)^g" \
|
2007-05-02 01:16:38 +02:00
|
|
|
-e "s^@tr\@^$(tr)^g" \
|
2006-03-01 13:15:33 +01:00
|
|
|
-e "s^@dot\@^$(dot)^g" \
|
2006-03-01 14:25:08 +01:00
|
|
|
-e "s^@xmllint\@^$(xmllint)^g" \
|
|
|
|
|
-e "s^@xmlflags\@^$(xmlflags)^g" \
|
|
|
|
|
-e "s^@xsltproc\@^$(xsltproc)^g" \
|
2010-02-24 12:06:17 +01:00
|
|
|
-e "s^@sqlite_bin\@^$(sqlite_bin)^g" \
|
2004-01-02 17:04:53 +01:00
|
|
|
-e "s^@version\@^$(VERSION)^g" \
|
2012-05-11 01:03:23 +02:00
|
|
|
-e "s^@perlbindings\@^$(perlbindings)^g" \
|
2010-10-04 17:50:08 +02:00
|
|
|
-e "s^@testPath\@^$(coreutils):$$(dirname $$(type -p expr))^g" \
|
Support cryptographically signed binary caches
NAR info files in binary caches can now have a cryptographic signature
that Nix will verify before using the corresponding NAR file.
To create a private/public key pair for signing and verifying a binary
cache, do:
$ openssl genrsa -out ./cache-key.sec 2048
$ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub
You should also come up with a symbolic name for the key, such as
"cache.example.org-1". This will be used by clients to look up the
public key. (It's a good idea to number keys, in case you ever need
to revoke/replace one.)
To create a binary cache signed with the private key:
$ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1
The public key (cache-key.pub) should be distributed to the clients.
They should have a nix.conf should contain something like:
signed-binary-caches = *
binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub
If all works well, then if Nix fetches something from the signed
binary cache, you will see a message like:
*** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’...
On the other hand, if the signature is wrong, you get a message like
NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring
Signatures are implemented as a single line appended to the NAR info
file, which looks like this:
Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ==
Thus the signature has 3 fields: a version (currently "1"), the ID of
key, and the base64-encoded signature of the SHA-256 hash of the
contents of the NAR info file up to but not including the Signature
line.
Issue #75.
2014-01-08 15:23:41 +01:00
|
|
|
-e "s^@openssl\@^$(openssl_prog)^g" \
|
2003-07-20 21:29:38 +02:00
|
|
|
< $< > $@ || rm $@
|
2004-01-02 17:04:53 +01:00
|
|
|
if test -x $<; then chmod +x $@; fi
|
2013-03-08 01:27:04 +01:00
|
|
|
|
|
|
|
|
$(CONFIG_HEADER):
|
|
|
|
|
true
|
