feat(tvix/store): Add a signing PathInfoService

- Add a new PathInfoService implementation that wraps transparently
around another except that it dynamically signs all the incoming
path-infos with the provided signer.

- Add a ServiceBuilder for this PathInfoService that provides a
SigningPathInfoService with a keyfile signer

Change-Id: I845ddfdf01d14c503c796b2b80c720dab98be091
Reviewed-on: https://cl.tvl.fyi/c/depot/+/12032
Reviewed-by: flokli <flokli@flokli.de>
Autosubmit: sinavir <tvix@sinavir.fr>
Tested-by: BuildkiteCI
This commit is contained in:
sinavir 2024-07-22 15:09:10 +02:00 committed by clbot
parent e4378f0143
commit 9f36632509
6 changed files with 225 additions and 0 deletions

2
tvix/Cargo.lock generated
View file

@ -4696,6 +4696,8 @@ dependencies = [
"clap",
"count-write",
"data-encoding",
"ed25519",
"ed25519-dalek",
"futures",
"hyper-util",
"lazy_static",

View file

@ -15572,6 +15572,14 @@ rec {
name = "data-encoding";
packageId = "data-encoding";
}
{
name = "ed25519";
packageId = "ed25519";
}
{
name = "ed25519-dalek";
packageId = "ed25519-dalek";
}
{
name = "futures";
packageId = "futures";

View file

@ -13,6 +13,8 @@ bytes = { workspace = true }
clap = { workspace = true, features = ["derive", "env"] }
count-write = { workspace = true }
data-encoding = { workspace = true }
ed25519 = { workspace = true }
ed25519-dalek = { workspace = true }
futures = { workspace = true }
lazy_static = { workspace = true }
nix-compat = { path = "../nix-compat", features = ["async"] }

View file

@ -5,6 +5,7 @@ mod lru;
mod memory;
mod nix_http;
mod redb;
mod signing_wrapper;
mod sled;
#[cfg(any(feature = "fuse", feature = "virtiofs"))]
@ -30,8 +31,12 @@ pub use self::lru::{LruPathInfoService, LruPathInfoServiceConfig};
pub use self::memory::{MemoryPathInfoService, MemoryPathInfoServiceConfig};
pub use self::nix_http::{NixHTTPPathInfoService, NixHTTPPathInfoServiceConfig};
pub use self::redb::{RedbPathInfoService, RedbPathInfoServiceConfig};
pub use self::signing_wrapper::{KeyFileSigningPathInfoServiceConfig, SigningPathInfoService};
pub use self::sled::{SledPathInfoService, SledPathInfoServiceConfig};
#[cfg(test)]
pub(crate) use self::signing_wrapper::test_signing_service;
#[cfg(feature = "cloud")]
mod bigtable;
#[cfg(feature = "cloud")]
@ -91,6 +96,7 @@ pub(crate) fn register_pathinfo_services(reg: &mut Registry) {
reg.register::<Box<dyn ServiceBuilder<Output = dyn PathInfoService>>, NixHTTPPathInfoServiceConfig>("nix");
reg.register::<Box<dyn ServiceBuilder<Output = dyn PathInfoService>>, SledPathInfoServiceConfig>("sled");
reg.register::<Box<dyn ServiceBuilder<Output = dyn PathInfoService>>, RedbPathInfoServiceConfig>("redb");
reg.register::<Box<dyn ServiceBuilder<Output = dyn PathInfoService>>, KeyFileSigningPathInfoServiceConfig>("keyfile-signing");
#[cfg(feature = "cloud")]
{
reg.register::<Box<dyn ServiceBuilder<Output = dyn PathInfoService>>, BigtableParameters>(

View file

@ -0,0 +1,204 @@
//! This module provides a [PathInfoService] implementation that signs narinfos
use super::PathInfoService;
use crate::proto::PathInfo;
use futures::stream::BoxStream;
use std::path::PathBuf;
use std::sync::Arc;
use tonic::async_trait;
use tvix_castore::composition::{CompositionContext, ServiceBuilder};
use tvix_castore::Error;
use nix_compat::narinfo::{parse_keypair, SigningKey};
use nix_compat::nixbase32;
use tracing::{instrument, warn};
#[cfg(test)]
use super::MemoryPathInfoService;
/// PathInfoService that wraps around an inner [PathInfoService] and when put is called it extracts
/// the underlying narinfo and signs it using a [SigningKey]. For the moment only the
/// [ed25519::signature::Signer<ed25519::Signature>] is available using a keyfile (see
/// [KeyFileSigningPathInfoServiceConfig] for more informations). However the implementation is
/// generic (see [nix_compat::narinfo::SigningKey] documentation).
///
/// The [PathInfo] with the added signature is then put into the inner [PathInfoService].
///
/// The service signs the [PathInfo] **only if it has a narinfo attribute**
pub struct SigningPathInfoService<T, S> {
/// The inner [PathInfoService]
inner: T,
/// The key to sign narinfos
signing_key: Arc<SigningKey<S>>,
}
impl<T, S> SigningPathInfoService<T, S> {
pub fn new(inner: T, signing_key: Arc<SigningKey<S>>) -> Self {
Self { inner, signing_key }
}
}
#[async_trait]
impl<T, S> PathInfoService for SigningPathInfoService<T, S>
where
T: PathInfoService,
S: ed25519::signature::Signer<ed25519::Signature> + Sync + Send,
{
#[instrument(level = "trace", skip_all, fields(path_info.digest = nixbase32::encode(&digest)))]
async fn get(&self, digest: [u8; 20]) -> Result<Option<PathInfo>, Error> {
self.inner.get(digest).await
}
async fn put(&self, path_info: PathInfo) -> Result<PathInfo, Error> {
let store_path = path_info.validate().map_err(|e| {
warn!(err=%e, "invalid PathInfo");
Error::StorageError(e.to_string())
})?;
let root_node = path_info.node.clone();
// If we have narinfo then sign it, else passthrough to the upper pathinfoservice
let path_info_to_put = match path_info.to_narinfo(store_path.as_ref()) {
Some(mut nar_info) => {
nar_info.add_signature(self.signing_key.as_ref());
let mut signed_path_info = PathInfo::from(&nar_info);
signed_path_info.node = root_node;
signed_path_info
}
None => path_info,
};
self.inner.put(path_info_to_put).await
}
fn list(&self) -> BoxStream<'static, Result<PathInfo, Error>> {
self.inner.list()
}
}
/// [ServiceBuilder] implementation that builds a [SigningPathInfoService] that signs narinfos using
/// a keyfile. The keyfile is parsed using [parse_keypair], the expected format is the nix one
/// (`nix-store --generate-binary-cache-key` for more informations).
#[derive(serde::Deserialize)]
pub struct KeyFileSigningPathInfoServiceConfig {
/// Inner [PathInfoService], will be resolved using a [CompositionContext].
pub inner: String,
/// Path to the keyfile in the nix format. It will be accessed once when building the service
pub keyfile: PathBuf,
}
impl TryFrom<url::Url> for KeyFileSigningPathInfoServiceConfig {
type Error = Box<dyn std::error::Error + Send + Sync>;
fn try_from(_url: url::Url) -> Result<Self, Self::Error> {
Err(Error::StorageError(
"Instantiating a SigningPathInfoService from a url is not supported".into(),
)
.into())
}
}
#[async_trait]
impl ServiceBuilder for KeyFileSigningPathInfoServiceConfig {
type Output = dyn PathInfoService;
async fn build<'a>(
&'a self,
_instance_name: &str,
context: &CompositionContext,
) -> Result<Arc<dyn PathInfoService>, Box<dyn std::error::Error + Send + Sync + 'static>> {
let inner = context.resolve(self.inner.clone()).await?;
let signing_key = Arc::new(
parse_keypair(tokio::fs::read_to_string(&self.keyfile).await?.trim())
.map_err(|e| Error::StorageError(e.to_string()))?
.0,
);
Ok(Arc::new(SigningPathInfoService { inner, signing_key }))
}
}
#[cfg(test)]
pub(crate) fn test_signing_service() -> Arc<dyn PathInfoService> {
let memory_svc: Arc<dyn PathInfoService> = Arc::new(MemoryPathInfoService::default());
Arc::new(SigningPathInfoService {
inner: memory_svc,
signing_key: Arc::new(
parse_keypair(DUMMY_KEYPAIR)
.expect("DUMMY_KEYPAIR to be valid")
.0,
),
})
}
#[cfg(test)]
pub const DUMMY_KEYPAIR: &str = "do.not.use:sGPzxuK5WvWPraytx+6sjtaff866sYlfvErE6x0hFEhy5eqe7OVZ8ZMqZ/ME/HaRdKGNGvJkyGKXYTaeA6lR3A==";
#[cfg(test)]
pub const DUMMY_VERIFYING_KEY: &str = "do.not.use:cuXqnuzlWfGTKmfzBPx2kXShjRryZMhil2E2ngOpUdw=";
#[cfg(test)]
mod test {
use crate::{
pathinfoservice::PathInfoService,
proto::PathInfo,
tests::fixtures::{DUMMY_PATH, PATH_INFO_WITH_NARINFO},
};
use nix_compat::narinfo::VerifyingKey;
use lazy_static::lazy_static;
use nix_compat::store_path::StorePath;
lazy_static! {
static ref PATHINFO_1: PathInfo = PATH_INFO_WITH_NARINFO.clone();
static ref PATHINFO_1_DIGEST: [u8; 20] = [0; 20];
}
#[tokio::test]
async fn put_and_verify_signature() {
let svc = super::test_signing_service();
// pathinfo_1 should not be there ...
assert!(svc
.get(*PATHINFO_1_DIGEST)
.await
.expect("no error")
.is_none());
// ... and not be signed
assert!(PATHINFO_1.narinfo.clone().unwrap().signatures.is_empty());
// insert it
svc.put(PATHINFO_1.clone()).await.expect("no error");
// now it should be there ...
let signed = svc
.get(*PATHINFO_1_DIGEST)
.await
.expect("no error")
.unwrap();
// and signed
let narinfo = signed
.to_narinfo(
StorePath::from_bytes(DUMMY_PATH.as_bytes()).expect("DUMMY_PATH to be parsed"),
)
.expect("no error");
let fp = narinfo.fingerprint();
// load our keypair from the fixtures
let (signing_key, _verifying_key) =
super::parse_keypair(super::DUMMY_KEYPAIR).expect("must succeed");
// ensure the signature is added
let new_sig = narinfo
.signatures
.last()
.expect("The retrieved narinfo to be signed");
assert_eq!(signing_key.name(), *new_sig.name());
// verify the new signature against the verifying key
let verifying_key =
VerifyingKey::parse(super::DUMMY_VERIFYING_KEY).expect("parsing dummy verifying key");
assert!(
verifying_key.verify(&fp, new_sig),
"expect signature to be valid"
);
}
}

View file

@ -14,6 +14,8 @@ use crate::proto::PathInfo;
use crate::tests::fixtures::DUMMY_PATH_DIGEST;
use tvix_castore::proto as castorepb;
use crate::pathinfoservice::test_signing_service;
mod utils;
pub use self::utils::make_grpc_path_info_service_client;
@ -29,6 +31,7 @@ use self::utils::make_bigtable_path_info_service;
})]
#[case::sled(SledPathInfoService::new_temporary().unwrap())]
#[case::redb(RedbPathInfoService::new_temporary().unwrap())]
#[case::signing(test_signing_service())]
#[cfg_attr(all(feature = "cloud",feature="integration"), case::bigtable(make_bigtable_path_info_service().await))]
pub fn path_info_services(#[case] svc: impl PathInfoService) {}