From f023bb10b56054c5123f2a017e04cb9d47d46b04 Mon Sep 17 00:00:00 2001 From: sinavir Date: Mon, 22 Jul 2024 15:09:10 +0200 Subject: [PATCH] feat(tvix/store): Add a signing PathInfoService - Add a new PathInfoService implementation that wraps transparently around another except that it dynamically signs all the incoming path-infos with the provided signer. - Add a ServiceBuilder for this PathInfoService that provides a SigningPathInfoService with a keyfile signer Change-Id: I845ddfdf01d14c503c796b2b80c720dab98be091 --- tvix/Cargo.lock | 1 + tvix/Cargo.nix | 4 + tvix/store/Cargo.toml | 1 + tvix/store/src/pathinfoservice/mod.rs | 3 + .../src/pathinfoservice/signing_wrapper.rs | 99 +++++++++++++++++++ 5 files changed, 108 insertions(+) create mode 100644 tvix/store/src/pathinfoservice/signing_wrapper.rs diff --git a/tvix/Cargo.lock b/tvix/Cargo.lock index cb3ed4c09..781e143f2 100644 --- a/tvix/Cargo.lock +++ b/tvix/Cargo.lock @@ -4995,6 +4995,7 @@ dependencies = [ "clap", "count-write", "data-encoding", + "ed25519", "futures", "hyper-util", "lazy_static", diff --git a/tvix/Cargo.nix b/tvix/Cargo.nix index 926145c31..d20893a5d 100644 --- a/tvix/Cargo.nix +++ b/tvix/Cargo.nix @@ -16408,6 +16408,10 @@ rec { name = "data-encoding"; packageId = "data-encoding"; } + { + name = "ed25519"; + packageId = "ed25519"; + } { name = "futures"; packageId = "futures"; diff --git a/tvix/store/Cargo.toml b/tvix/store/Cargo.toml index de7d0a504..dfe49e7ff 100644 --- a/tvix/store/Cargo.toml +++ b/tvix/store/Cargo.toml @@ -13,6 +13,7 @@ bytes = "1.4.0" clap = { version = "4.0", features = ["derive", "env"] } count-write = "0.1.0" data-encoding = "2.6.0" +ed25519 = "2.2.3" futures = "0.3.30" lazy_static = "1.4.0" nix-compat = { path = "../nix-compat", features = ["async"] } diff --git a/tvix/store/src/pathinfoservice/mod.rs b/tvix/store/src/pathinfoservice/mod.rs index d118a8af1..4b241d935 100644 --- a/tvix/store/src/pathinfoservice/mod.rs +++ b/tvix/store/src/pathinfoservice/mod.rs @@ -5,6 +5,7 @@ mod lru; mod memory; mod nix_http; mod redb; +mod signing_wrapper; mod sled; #[cfg(any(feature = "fuse", feature = "virtiofs"))] @@ -30,6 +31,7 @@ pub use self::lru::{LruPathInfoService, LruPathInfoServiceConfig}; pub use self::memory::{MemoryPathInfoService, MemoryPathInfoServiceConfig}; pub use self::nix_http::{NixHTTPPathInfoService, NixHTTPPathInfoServiceConfig}; pub use self::redb::{RedbPathInfoService, RedbPathInfoServiceConfig}; +pub use self::signing_wrapper::{KeyFileSigningPathInfoServiceConfig, SigningPathInfoService}; pub use self::sled::{SledPathInfoService, SledPathInfoServiceConfig}; #[cfg(feature = "cloud")] @@ -91,6 +93,7 @@ pub(crate) fn register_pathinfo_services(reg: &mut Registry) { reg.register::>, NixHTTPPathInfoServiceConfig>("nix"); reg.register::>, SledPathInfoServiceConfig>("sled"); reg.register::>, RedbPathInfoServiceConfig>("redb"); + reg.register::>, KeyFileSigningPathInfoServiceConfig>("keyfile-signing"); #[cfg(feature = "cloud")] { reg.register::>, BigtableParameters>( diff --git a/tvix/store/src/pathinfoservice/signing_wrapper.rs b/tvix/store/src/pathinfoservice/signing_wrapper.rs new file mode 100644 index 000000000..5ff4473f2 --- /dev/null +++ b/tvix/store/src/pathinfoservice/signing_wrapper.rs @@ -0,0 +1,99 @@ +//! This module provides a [PathInfoService] implementation that signs narinfos + +use super::PathInfoService; +use crate::proto::PathInfo; +use futures::stream::BoxStream; +use std::path::PathBuf; +use std::sync::Arc; +use tonic::async_trait; + +use tvix_castore::composition::{CompositionContext, ServiceBuilder}; + +use tvix_castore::Error; + +use nix_compat::narinfo::{parse_keypair, SigningKey}; +use nix_compat::nixbase32; +use tracing::{instrument, warn}; + +/// Wraps around an inner [PathInfoService]. +/// When put is called, extracts the underlying nar info and signs it using a [SigningKey]. +/// The reconstructed [PathInfo is the put into the inner [PathInfoService]. +pub struct SigningPathInfoService { + /// The inner [PathInfoService] + inner: T, + signing_key: Arc>, +} + +impl SigningPathInfoService { + pub fn new(inner: T, signing_key: Arc>) -> Self { + Self { inner, signing_key } + } +} + +#[async_trait] +impl PathInfoService for SigningPathInfoService +where + T: PathInfoService, + S: ed25519::signature::Signer + Sync + Send, +{ + #[instrument(level = "trace", skip_all, fields(path_info.digest = nixbase32::encode(&digest)))] + async fn get(&self, digest: [u8; 20]) -> Result, Error> { + self.inner.get(digest).await + } + + async fn put(&self, path_info: PathInfo) -> Result { + let store_path = path_info.validate().map_err(|e| { + warn!(err=%e, "invalid PathInfo"); + Error::StorageError(e.to_string()) + })?; + let root_node = path_info.node.clone(); + let mut nar_info = path_info.to_narinfo(store_path).ok_or(Error::StorageError( + "Can't render narinfo to create a signature".to_string(), + ))?; + nar_info.add_signature(self.signing_key.as_ref()); + let mut signed_path_info = PathInfo::from(&nar_info); + signed_path_info.node = root_node; + self.inner.put(signed_path_info).await + } + + fn list(&self) -> BoxStream<'static, Result> { + self.inner.list() + } +} + +/// [ServiceConfig] implementation that builds a [SigningPathInfoService] that signs narinfos using +/// a keyfile. The keyfile is parsed using [parse_keypair], the expected format is the nix one +/// (`nix-store --generate-binary-cache-key` for more informations). +#[derive(serde::Deserialize)] +pub struct KeyFileSigningPathInfoServiceConfig { + pub inner: String, + pub keyfile: PathBuf, +} + +impl TryFrom for KeyFileSigningPathInfoServiceConfig { + type Error = Box; + fn try_from(_url: url::Url) -> Result { + Err(Error::StorageError( + "Instantiating a SigningPathInfoService from a url is not supported".into(), + ) + .into()) + } +} + +#[async_trait] +impl ServiceBuilder for KeyFileSigningPathInfoServiceConfig { + type Output = dyn PathInfoService; + async fn build<'a>( + &'a self, + _instance_name: &str, + context: &CompositionContext, + ) -> Result, Box> { + let inner = context.resolve(self.inner.clone()).await?; + let signing_key = Arc::new( + parse_keypair(tokio::fs::read_to_string(&self.keyfile).await?.trim()) + .map_err(|e| Error::StorageError(e.to_string()))? + .0, + ); + Ok(Arc::new(SigningPathInfoService { inner, signing_key })) + } +}