mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

signed-binary-caches -> require-sigs

Browse source 
Unlike signed-binary-caches (which could only be '*' or ''),
require-sigs is a proper Boolean option. The default is true.
This commit is contained in:
Eelco Dolstra 2017-11-20 17:44:07 +01:00
parent d0b88db441
commit 91a1987607
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
5 changed files with 25 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
doc/manual/command-ref/conf-file.xml
View file

@ -402,12 +402,15 @@ false</literal>.</para>
</varlistentry> </varlistentry>
<varlistentry><term><literal>signed-binary-caches</literal></term> <varlistentry><term><literal>require-sigs</literal></term>
<listitem><para>If set to <literal>*</literal> (the default), Nix <listitem><para>If set to <literal>true</literal> (the default),
will only download binaries if they are signed using one of the any non-content-addressed path added or copied to the Nix store
keys listed in <option>trusted-public-keys</option>. Set to (e.g. when substituting from a binary cache) must have a valid
the empty string to disable signature checking.</para></listitem> signature, that is, be signed using one of the keys listed in
<option>trusted-public-keys</option>. Set to
<literal>false</literal> to disable signature
checking.</para></listitem>
</varlistentry> </varlistentry>

5
src/libstore/globals.hh
View file

@ -281,6 +281,11 @@ public:
Setting<std::string> signedBinaryCaches{this, "*", "signed-binary-caches", Setting<std::string> signedBinaryCaches{this, "*", "signed-binary-caches",
"Obsolete."}; "Obsolete."};
Setting<bool> requireSigs{this, signedBinaryCaches == "*", "require-sigs",
"Whether to check that any non-content-addressed path added to the "
"Nix store has a valid signature (that is, one signed using a key "
"listed in 'trusted-public-keys'."};
Setting<Strings> substituters{this, Setting<Strings> substituters{this,
nixStore == "/nix/store" ? Strings{"https://cache.nixos.org/"} : Strings(), nixStore == "/nix/store" ? Strings{"https://cache.nixos.org/"} : Strings(),
"substituters", "substituters",

2
src/libstore/local-store.hh
View file

@ -97,7 +97,7 @@ public:
private: private:
Setting<bool> requireSigs{(Store*) this, Setting<bool> requireSigs{(Store*) this,
settings.signedBinaryCaches != "", // FIXME settings.requireSigs,
"require-sigs", "whether store paths should have a trusted signature on import"}; "require-sigs", "whether store paths should have a trusted signature on import"};
PublicKeys publicKeys; PublicKeys publicKeys;

18
tests/binary-cache.sh
View file

@ -18,7 +18,7 @@ basicTests() {
nix-env --option binary-caches "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---" nix-env --option binary-caches "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---"
nix-store --option binary-caches "file://$cacheDir" --option signed-binary-caches '' -r $outPath nix-store --option binary-caches "file://$cacheDir" --no-require-sigs -r $outPath
[ -x $outPath/program ] [ -x $outPath/program ]
@ -34,7 +34,7 @@ basicTests() {
x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only) x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only)
[ -z "$x" ] [ -z "$x" ]
nix-store --option binary-caches "file://$cacheDir" --option signed-binary-caches '' -r $outPath nix-store --option binary-caches "file://$cacheDir" --no-require-sigs -r $outPath
nix-store --check-validity $outPath nix-store --check-validity $outPath
nix-store -qR $outPath | grep input-2 nix-store -qR $outPath | grep input-2
@ -63,7 +63,7 @@ mv $nar $nar.good
mkdir -p $TEST_ROOT/empty mkdir -p $TEST_ROOT/empty
nix-store --dump $TEST_ROOT/empty | xz > $nar nix-store --dump $TEST_ROOT/empty | xz > $nar
nix-build --option binary-caches "file://$cacheDir" --option signed-binary-caches '' dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log nix-build --option binary-caches "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
grep -q "hash mismatch" $TEST_ROOT/log grep -q "hash mismatch" $TEST_ROOT/log
mv $nar.good $nar mv $nar.good $nar
@ -99,7 +99,7 @@ clearStore
rm $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo) rm $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo)
nix-build --option binary-caches "file://$cacheDir" --option signed-binary-caches '' dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log nix-build --option binary-caches "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
grep -q "copying path" $TEST_ROOT/log grep -q "copying path" $TEST_ROOT/log
@ -124,18 +124,18 @@ nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
clearStore clearStore
clearCacheCache clearCacheCache
(! nix-store -r $outPath --option binary-caches "file://$cacheDir" --option signed-binary-caches '*' ) (! nix-store -r $outPath --option binary-caches "file://$cacheDir")
# And it should fail if we provide an incorrect key. # And it should fail if we provide an incorrect key.
clearStore clearStore
clearCacheCache clearCacheCache
(! nix-store -r $outPath --option binary-caches "file://$cacheDir" --option signed-binary-caches '*' --option trusted-public-keys "$badKey") (! nix-store -r $outPath --option binary-caches "file://$cacheDir" --option trusted-public-keys "$badKey")
# It should succeed if we provide the correct key. # It should succeed if we provide the correct key.
nix-store -r $outPath --option binary-caches "file://$cacheDir" --option signed-binary-caches '*' --option trusted-public-keys "$otherKey $publicKey" nix-store -r $outPath --option binary-caches "file://$cacheDir" --option trusted-public-keys "$otherKey $publicKey"
# It should fail if we corrupt the .narinfo. # It should fail if we corrupt the .narinfo.
@ -152,10 +152,10 @@ done
clearCacheCache clearCacheCache
(! nix-store -r $outPath --option binary-caches "file://$cacheDir2" --option signed-binary-caches '*' --option trusted-public-keys "$publicKey") (! nix-store -r $outPath --option binary-caches "file://$cacheDir2" --option trusted-public-keys "$publicKey")
# If we provide a bad and a good binary cache, it should succeed. # If we provide a bad and a good binary cache, it should succeed.
nix-store -r $outPath --option binary-caches "file://$cacheDir2 file://$cacheDir" --option signed-binary-caches '*' --option trusted-public-keys "$publicKey" nix-store -r $outPath --option binary-caches "file://$cacheDir2 file://$cacheDir" --option trusted-public-keys "$publicKey"
fi # HAVE_LIBSODIUM fi # HAVE_LIBSODIUM

4
tests/repair.sh
View file

@ -51,7 +51,7 @@ nix copy --to file://$cacheDir $path
chmod u+w $path2 chmod u+w $path2
rm -rf $path2 rm -rf $path2
nix-store --verify --check-contents --repair --option binary-caches "file://$cacheDir" --option signed-binary-caches '' nix-store --verify --check-contents --repair --option binary-caches "file://$cacheDir" --no-require-sigs
if [ "$(nix-hash $path2)" != "$hash" -o -e $path2/bad ]; then if [ "$(nix-hash $path2)" != "$hash" -o -e $path2/bad ]; then
echo "path not repaired properly" >&2 echo "path not repaired properly" >&2
@ -69,7 +69,7 @@ if nix-store --verify-path $path2; then
exit 1 exit 1
fi fi
nix-store --repair-path $path2 --option binary-caches "file://$cacheDir" --option signed-binary-caches '' nix-store --repair-path $path2 --option binary-caches "file://$cacheDir" --no-require-sigs
if [ "$(nix-hash $path2)" != "$hash" -o -e $path2/bad ]; then if [ "$(nix-hash $path2)" != "$hash" -o -e $path2/bad ]; then
echo "path not repaired properly" >&2 echo "path not repaired properly" >&2