| Age | Commit message (Expand) | Author |
|---|
| 2023-09-24 | Revert "build: Add missing guix-gc.timer file to binary tarball."...This reverts commit 69f6edc1a8596d2cb4c67e0435d35633af6f3cbc.
The intention is good, but nodist_systemdservice_DATA are meant to be
disposable artefacts generated from corresponding ‘.in’ files.
etc/guix-gc.timer doesn't fit that description, breaking builds:
$ make clean && make
…
make[2]: *** No rule to make target 'etc/guix-gc.timer', needed by 'all-am'. Stop.
| Tobias Geerinckx-Rice |
| 2023-09-26 | daemon: Add “git-download” built-in builder....The new builder makes it possible to break cycles that occurs when the
fixed-output derivation for the source of a dependency of ‘git’ would
itself depend on ‘git’.
* guix/scripts/perform-download.scm (perform-git-download): New
procedure.
(perform-download): Move fixed-output derivation check to…
(guix-perform-download): … here. Invoke ‘perform-download’ or
‘perform-git-download’ depending on what ‘derivation-builder’ returns.
* nix/libstore/builtins.cc (builtins): Add “git-download”.
* tests/derivations.scm ("built-in-builders"): Update.
("'git-download' built-in builder")
("'git-download' built-in builder, invalid hash")
("'git-download' built-in builder, invalid commit")
("'git-download' built-in builder, not found"): New tests.
| Ludovic Courtès |
| 2023-09-09 | daemon: Fix build with GCC 13....The sqlite.hh file uses fixed-width integer types from stdint.h. As
such, it needs to include <cstdint>. Without this include, the file
doesn't compile successfully with GCC13.
See: https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes
* nix/libstore/sqlite.hh: include <cstdint>
Signed-off-by: Sören Tempel <soeren@soeren-tempel.net>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| Sören Tempel |
| 2023-08-31 | build: Add missing guix-gc.timer file to binary tarball....Partially fixes <https://issues.guix.gnu.org/65117>.
* nix/local.mk (nodist_systemdservice_DATA): Add etc/guix-gc.timer.
| Maxim Cournoyer |
| 2023-01-09 | daemon: Improve error message for wrong hash sizes....* nix/libutil/hash.cc (parseHash): Show the hash algorithm name and
expected size in the error message.
* tests/derivations.scm ("fixed-output derivation, invalid hash size"):
New test.
| Ludovic Courtès |
| 2022-12-18 | daemon: Make "opening file" error messages distinguishable....* nix/libstore/build.cc (DerivationGoal::openLogFile): Customize
"opening file" error message.
* nix/libutil/hash.cc (hashFile): Likewise.
* nix/libutil/util.cc (readFile, writeFile): Likewise.
| Ludovic Courtès |
| 2022-10-17 | Revert "nix: Guard against removing temporary roots of living processes."...This reverts commit bb0beaecdee1a2315a1269b1746d238c8ab0e699. This
change broke a number of tests that assumed the previous behavior.
| Ludovic Courtès |
| 2022-10-07 | nix: Guard against removing temporary roots of living processes....Fixes <https://issues.guix.gnu.org/25018>.
* nix/libstore/gc.cc (readTempRoots): Add a check to guard against removing
the temporary roots of a living process.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
| Ludovic Courtès |
| 2022-09-11 | daemon: Remove unused function findOutput....* nix/libstore/misc.cc (findOutput): Remove it.
* nix/libstore/misc.hh (findOutput): Likewise.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
| Maxime Devos |
| 2022-09-11 | daemon: Remove unused function exportPaths....* nix/libstore/store-api.cc (exportPaths): Remove it.
* nix/libstore/store-api.hh (exportPaths): Likewise.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
| Maxime Devos |
| 2022-09-11 | daemon: Remove unused function openStore....* nix/libstore/store-api.cc (openStore): Remove it.
* nix/libstore/store-api.hh (openStore): Likewise.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
| Maxime Devos |
| 2022-06-05 | daemon: Quote consistently within a string....* nix/libstore/build.cc (DerivationGoal::registerOutput): ‘’ → `'.
| Tobias Geerinckx-Rice |
| 2022-05-29 | daemon: Clarify ‘--check’ error when outputs are missing....Drop the confusing ‘invalid’ jargon and display a hint like we do
for ‘--fallback’.
* nix/libstore/build.cc (DerivationGoal::outputsSubstituted): Rewrite error message.
| Tobias Geerinckx-Rice |
| 2022-05-18 | daemon: runChild() is forbidden to talk during environment set up...DerivationGoal::startBuilder() is waiting for an empty line as a check that
the environment set up is fine.
Fixes <https://issues.guix.gnu.org/55324>.
* nix/libstore/build.cc (DerivationGoal::runChild): Remove 'debug'
statement corresponding to bind mounts.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| yarl-baudig@mailoo.org |
| 2022-04-14 | daemon: Support systemd-style socket activation....* nix/nix-daemon/guix-daemon.cc (SD_LISTEN_FDS_START): New macro.
(systemd_activation_sockets): New function.
(main): Use it. Remove obsolete 'printMsg' call.
* doc/guix.texi (Invoking guix-daemon): Document socket activation.
| Ludovic Courtès |
| 2022-01-18 | daemon: Always default to gzip for log compression....* nix/libstore/globals.cc (Settings::Settings): Have 'logCompression'
default to COMPRESSION_GZIP unconditionally.
* gnu/services/base.scm (<guix-configuration>)[log-compression]: Default
to 'gzip.
* doc/guix.texi (Invoking guix-daemon, Base Services): Adjust accordingly.
| Ludovic Courtès |
| 2021-11-27 | daemon: Print the line whence we expect an integer....* nix/libstore/local-store.cc (LocalStore::getLineFromSubstituter):
Include the malformed substituter stream line in the error message.
| Tobias Geerinckx-Rice |
| 2021-11-25 | daemon: Read substitute nar size as 'unsigned long long'....Fixes <https://issues.guix.gnu.org/46212>.
Reported by Christopher Baines <mail@cbaines.net>.
Previously, the nar size returned by 'guix substitute' would be read as
an 'int'; thus, values above 2^31 - 1 would be read and then stored as
negative integers in the database.
Regression introduced in 9dfa20a22ae0be3d3b01a7b3d422af97428c627e.
* nix/libstore/build.cc (SubstitutionGoal::finished): Use templatized
'string2Int' instead of 'std::atoi' to get an 'unsigned long long',
which is the type of 'hash.second'.
* tests/store.scm ("substitute and large size"): New test.
| Ludovic Courtès |
| 2021-11-25 | daemon: Read unsigned nar size and download size from substituter....Fixes <https://issues.guix.gnu.org/51983>.
Reported by Tobias Geerinckx-Rice <me@tobias.gr>.
* nix/libstore/local-store.cc (LocalStore::querySubstitutablePathInfos):
Expect 'unsigned long long' for 'downloadSize' and 'narSize'.
* tests/store.scm ("substitute query and large size"): New test.
| Ludovic Courtès |
| 2021-11-19 | daemon: Micro-optimize 'deletePath'....'remove' calls 'unlink' first and falls back to 'rmdir' upon EISDIR.
This change gets rid of the 'unlink' call for every directory being
removed.
* nix/libutil/util.cc (_deletePath): Call 'unlink' or 'rmdir' depending
on 'st.st_mode', rather than call 'remove'.
| Ludovic Courtès |
| 2021-11-16 | daemon: Do not deduplicate files smaller than 8 KiB....Files smaller than 8 KiB typically represent ~70% of the entries in
/gnu/store/.links but only contribute to ~4% of the space savings
afforded by deduplication.
Not considering these files for deduplication speeds up file insertion
in the store and, more importantly, leaves 'removeUnusedLinks' with
fewer entries to traverse, thereby speeding it up proportionally.
Partly fixes <https://issues.guix.gnu.org/24937>.
* config-daemon.ac: Remove symlink hard link check and CAN_LINK_SYMLINK
definition.
* guix/store/deduplication.scm (%deduplication-minimum-size): New
variable.
(deduplicate)[loop]: Do not recurse when FILE's size is below
%DEDUPLICATION-MINIMUM-SIZE.
(dump-port): New procedure.
(dump-file/deduplicate)[hash]: Turn into...
[dump-and-compute-hash]: ... this thunk.
Call 'deduplicate' only when SIZE is greater than
%DEDUPLICATION-MINIMUM-SIZE; otherwise call 'dump-port'.
* nix/libstore/gc.cc (LocalStore::removeUnusedLinks): Drop files where
st.st_size < deduplicationMinSize.
* nix/libstore/local-store.hh (deduplicationMinSize): New declaration.
* nix/libstore/optimise-store.cc (deduplicationMinSize): New variable.
(LocalStore::optimisePath_): Return when PATH is a symlink or smaller
than 'deduplicationMinSize'.
* tests/derivations.scm ("identical files are deduplicated"): Produce
files bigger than %DEDUPLICATION-MINIMUM-SIZE.
* tests/nar.scm ("restore-file-set with directories (signed, valid)"):
Likewise.
* tests/store-deduplication.scm ("deduplicate, below %deduplication-minimum-size"):
New test.
("deduplicate", "deduplicate, ENOSPC"): Produce files bigger than
%DEDUPLICATION-MINIMUM-SIZE.
* tests/store.scm ("substitute, deduplication"): Likewise.
| Ludovic Courtès |
| 2021-10-01 | build: Don’t delete ‘guix-gc.timer’ file....Without this invoking ‘make clean’ would remove ‘guix-gc.timer’, and ‘make’
would fail with.
make[2]: *** No rule to make target 'etc/guix-gc.timer', needed by 'all-am'. Stop.
* nix/local.mk (nodist_systemdservice_DATA): Remove ‘guix-gc.timer’.
| Xinglu Chen |
| 2021-09-20 | etc: Add systemd files for running ‘guix gc’ periodically...* etc/guix-gc.service.in: New file.
* etc/guix-gc.timer: Likewise.
* .gitignore: Ignore generated ‘guix-gc.service’.
* nix/local.mk (nodist_systemdservice_DATA): Add ‘guix-gc.service’ and
‘guix-gc.timer’.
(EXTRA_DIST): Add ‘guix-gc.service.in’ and ‘guix-gc.timer’.
* doc/guix.texi (Binary Installation): Mention the new systemd files.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
| Thiago Jung Bauermann |
| 2021-04-09 | daemon: 'guix substitute' replies on FD 4....This avoids the situation where error messages would unintentionally go
to stderr and be wrongfully interpreted as a reply by the daemon.
Fixes <https://bugs.gnu.org/46362>.
This is a followup to ee3226e9d54891c7e696912245e4904435be191c.
* guix/scripts/substitute.scm (display-narinfo-data): Add 'port'
parameter and honor it.
(process-query): Likewise.
(process-substitution): Likewise.
(%error-to-file-descriptor-4?, with-redirected-error-port): Remove.
(%reply-file-descriptor): New variable.
(guix-substitute): Remove use of 'with-redirected-error-port'. Define
'reply-port' and pass it to 'process-query' and 'process-substitution'.
* nix/libstore/build.cc (SubstitutionGoal::handleChildOutput): Swap
'builderOut' and 'fromAgent'.
* nix/libstore/local-store.cc (LocalStore::getLineFromSubstituter):
Likewise.
* tests/substitute.scm <top level>: Set '%reply-file-descriptor'
rather than '%error-to-file-descriptor-4?'.
| Ludovic Courtès |
| 2021-04-03 | daemon: Remove dead code....Reported by Noisytoot on #guix.
* nix/nix-daemon/shared.hh (showManPage): Remove.
* nix/nix-daemon/nix-daemon.cc (printHelp, programId): Remove.
| Ludovic Courtès |
| 2021-03-30 | gnu: guix: Fix openrc init scripts....Fixes <https://bugs.gnu.org/46871>.
* gnu/packages/package-management.scm (guix)[arguments]: Fix openrc init.
* nix/local.mk (openrcservicedir): Likewise.
Signed-off-by: Efraim Flashner <efraim@flashner.co.il>
| zimoun |
| 2021-03-18 | daemon: Prevent privilege escalation with '--keep-failed' [security]....Fixes <https://bugs.gnu.org/47229>.
Reported by Nathan Nye of WhiteBeam Security.
* nix/libstore/build.cc (DerivationGoal::startBuilder): When 'useChroot'
is true, add "/top" to 'tmpDir'.
(DerivationGoal::deleteTmpDir): Adjust accordingly. When
'settings.keepFailed' is true, chown in two steps: first the "/top"
sub-directory, and then rename "/top" to its parent.
| Ludovic Courtès |
| 2021-03-17 | daemon: Correctly handle '--discover' with no value....Previously, we'd get:
$ guix-daemon --discover
error: basic_string::_M_construct null not valid
* nix/nix-daemon/guix-daemon.cc (parse_opt): Change second argument to
'settings.set' to properly handle case where ARG is NULL.
| Ludovic Courtès |
| 2020-12-19 | daemon: Delegate deduplication to 'guix substitute'....This removes the main source of latency between subsequent downloads.
* nix/libstore/build.cc (SubstitutionGoal::tryToRun): Add a
"deduplicate" key to ENV.
(SubstitutionGoal::finished): Remove call to 'optimisePath'.
* guix/scripts/substitute.scm (process-substitution)[destination-in-store?]
[dump-file/deduplicate*]: New variables.
Pass #:dump-file to 'restore-file'.
* guix/scripts/substitute.scm (guix-substitute)[deduplicate?]: New
variable.
Pass #:deduplicate? to 'process-substitution'.
* guix/serialization.scm (dump-file): Export and augment 'dump-file'.
| Ludovic Courtès |
| 2020-12-19 | daemon: Do not reset timestamps and permissions on substituted items....'guix substitute' now takes care of it via 'restore-file'.
* nix/libstore/build.cc (SubstitutionGoal::finished): Remove call to
'canonicalisePathMetaData'.
| Ludovic Courtès |
| 2020-12-19 | daemon: Let 'guix substitute' perform hash checks....This way, the hash of the store item can be computed as it is restored,
thereby avoiding an additional file tree traversal ('hashPath' call)
later on in the daemon. Consequently, it should reduce latency between
subsequent substitute downloads.
This is a followup to 5ff521452b9ec2aae9ed8e4bb7bdc250a581f203.
* guix/scripts/substitute.scm (narinfo-hash-algorithm+value): New
procedure.
(process-substitution): Wrap INPUT into a hash input port, 'hashed', and
read from it. Compare the actual and expected hashes, and print a
"hash-mismatch" status line when they differ. When they match, print
not just "success" but also the nar hash and size.
* nix/libstore/build.cc (class SubstitutionGoal)[expectedHashStr]:
Remove.
(SubstitutionGoal::finished): Tokenize 'status'. Parse it and handle
"success" and "hash-mismatch" accordingly. Call 'hashPath' only when
the returned hash is not SHA256.
(SubstitutionGoal::handleChildOutput): Remove 'expectedHashStr'
handling.
* tests/substitute.scm ("substitute, invalid hash"): Rename to...
("substitute, invalid narinfo hash"): ... this.
("substitute, invalid hash"): New test.
| Ludovic Courtès |
| 2020-12-08 | daemon: Raise an error if substituter doesn't send the expected hash....It was already impossible in practice for 'expectedHashStr' to be empty
if 'status' == "success".
* nix/libstore/build.cc (SubstitutionGoal::finished): Throw 'SubstError'
when 'expectedHashStr' is empty.
| Ludovic Courtès |
| 2020-12-08 | substitute: Cache and reuse connections while substituting....That way, when fetching a series of substitutes from the same server(s),
the connection is reused instead of being closed/opened for each
substitutes, which saves on network round trips and TLS handshakes.
* guix/http-client.scm (http-fetch): Add #:keep-alive? and honor it.
* guix/progress.scm (progress-report-port): Add #:close? parameter and
honor it.
* guix/scripts/substitute.scm (at-most): Return the tail as a second
value.
(fetch): Add #:port and #:keep-alive? and honor them.
(%max-cached-connections): New variable.
(open-connection-for-uri/cached, call-with-cached-connection): New
procedures.
(with-cached-connection): New macro.
(process-substitution): Wrap 'fetch' call in 'with-cached-connection'.
Pass #:close? to 'progress-report-port'.
| Ludovic Courtès |
| 2020-12-08 | daemon: Run 'guix substitute --substitute' as an agent....This avoids spawning one substitute process per substitution.
* nix/libstore/build.cc (class Worker)[substituter]: New field.
[outPipe, logPipe, pid]: Remove.
(class SubstitutionGoal)[expectedHashStr, status, substituter]: New fields.
(SubstitutionGoal::timedOut): Adjust to check 'substituter'.
(SubstitutionGoal::tryToRun): Remove references to 'outPipe' and
'logPipe'. Run "guix substitute --substitute" as an 'Agent'. Send the
request with 'writeLine'.
(SubstitutionGoal::finished): Likewise.
(SubstitutionGoal::handleChildOutput): Change to fill in
'expectedHashStr' and 'status'.
(SubstitutionGoal::handleEOF): Call 'wakeUp' unconditionally.
(SubstitutionGoal::~SubstitutionGoal): Adjust to check 'substituter'.
* guix/scripts/substitute.scm (process-substitution): Write "success\n"
to stdout upon success.
(%error-to-file-descriptor-4?): New variable.
(guix-substitute): Set 'current-error-port' to file descriptor 4
unless (%error-to-file-descriptor-4?) is false.
Remove "--substitute" arguments. Loop reading line from stdin.
* tests/substitute.scm <top level>: Call '%error-to-file-descriptor-4?'.
(request-substitution): New procedure.
("substitute, no signature")
("substitute, invalid hash")
("substitute, unauthorized key")
("substitute, authorized key")
("substitute, unauthorized narinfo comes first")
("substitute, unsigned narinfo comes first")
("substitute, first narinfo is unsigned and has wrong hash")
("substitute, first narinfo is unsigned and has wrong refs")
("substitute, two invalid narinfos")
("substitute, narinfo with several URLs"): Adjust to new "guix
substitute --substitute" calling convention.
| Ludovic Courtès |
| 2020-12-08 | daemon: Factorize substituter agent spawning....* nix/libstore/local-store.hh (class LocalStore)[substituter]: New
method.
[runningSubstituter]: Turn into a shared_ptr.
* nix/libstore/local-store.cc (LocalStore::querySubstitutablePaths):
Call 'substituter' instead of using inline code.
(LocalStore::querySubstitutablePathInfos): Likewise.
(LocalStore::substituter): New method.
| Ludovic Courtès |
| 2020-12-08 | daemon: Use 'Agent' to spawn 'guix substitute --query'....* nix/libstore/local-store.hh (RunningSubstituter): Remove.
(LocalStore)[runningSubstituter]: Change to unique_ptr<Agent>.
[setSubstituterEnv, didSetSubstituterEnv]: Remove.
[getLineFromSubstituter, getIntLineFromSubstituter]: Take an 'Agent'.
* nix/libstore/local-store.cc (LocalStore::~LocalStore): Remove
reference to 'runningSubstituter'.
(LocalStore::setSubstituterEnv, LocalStore::startSubstituter): Remove.
(LocalStore::getLineFromSubstituter): Adjust to 'run' being an 'Agent'.
(LocalStore::querySubstitutablePaths): Spawn substituter agent if
needed. Adjust to 'Agent' interface.
(LocalStore::querySubstitutablePathInfos): Likewise.
* nix/libstore/build.cc (SubstitutionGoal::tryToRun): Remove call to
'setSubstituterEnv' and add 'setenv' call for "_NIX_OPTIONS" instead.
(SubstitutionGoal::finished): Remove 'readLine' call for 'dummy'.
* guix/scripts/substitute.scm (%allow-unauthenticated-substitutes?):
Remove second argument to 'make-parameter'.
(process-query): Call 'warn-about-missing-authentication'
when (%allow-unauthenticated-substitutes?) is #t.
(guix-substitute): Wrap body in 'parameterize'. Set 'guix-warning-port'
too. No longer exit when 'substitute-urls' returns the empty list. No
longer print newline initially.
* tests/substitute.scm (test-quit): Parameterize 'current-error-port' to
account for the port changes in 'guix-substitute'.
| Ludovic Courtès |
| 2020-12-08 | daemon: 'Agent' constructor takes a list of environment variables....* nix/libutil/util.hh (struct Agent)[Agent]: Add 'env' parameter.
* nix/libutil/util.cc (Agent::Agent): Honor it.
| Ludovic Courtès |
| 2020-12-01 | daemon: Remove unneeded forward declaration....This is a followup to ee9dff34f9317509cb2b833d07a0d5e01a36a4ae.
* nix/libstore/build.cc: Remove 'struct Agent' forward declaration.
| Ludovic Courtès |
| 2020-11-29 | daemon: Remove pre-Guix hack....* nix/libstore/build.cc (DerivationGoal::startBuilder): Remove
"NIX_OUTPUT_CHECKED" hack.
| Ludovic Courtès |
| 2020-11-29 | Use substitute servers on the local network....* guix/scripts/discover.scm: New file.
* Makefile.am (MODULES): Add it.
* nix/nix-daemon/guix-daemon.cc (options): Add "discover" option,
(parse-opt): parse it,
(main): start "guix discover" process when the option is set.
* guix/scripts/substitute.scm (%local-substitute-urls): New variable,
(substitute-urls): add it.
* gnu/services/base.scm (<guix-configuration>): Add "discover?"
field,
(guix-shepherd-service): honor it.
* doc/guix.texi (Invoking guix-daemon): Document "discover" option,
(Base Services): ditto.
| Mathieu Othacehe |
| 2020-10-27 | maint: Add 'etc/gnu-store.mount.in' to the distribution....Reported by Vagrant Cascadian.
* nix/local.mk (EXTRA_DIST): Add 'etc/gnu-store.mount.in'.
| Ludovic Courtès |
| 2020-10-09 | nix: Honor '--rounds' when also using '--check'....Fixes <https://issues.guix.gnu.org/40144>.
Until now, the '--rounds' option, when also using '--check', was ignored.
This change makes it possible to use both, so that an item that has already
been built once can be rebuilt as many times as desired.
* nix/libstore/build.cc: Remove the conditionals causing the daemon to
complete a build task early when 'buildMode' is equal to 'nix::bmCheck'.
Reported-by: Brice Waegeneire <brice@waegenei.re>
| Maxim Cournoyer |
| 2020-10-01 | daemon: Try to execute derivation builders only for matching OS kernels....Fixes <https://bugs.gnu.org/43668>.
Previously, guix-daemon would try to run GNU/Hurd executables on
GNU/Linux. execve(2) would succeed, but the executable would
immediately crash.
This change prevents it from attempting to execute "i586-gnu" code on
"*-linux", while preserving the binfmt_misc-friendly behavior
implemented in commit 7bf2a70a4ffd976d50638d3b9f2ec409763157df.
* nix/libstore/build.cc (sameOperatingSystemKernel): New function.
(DerivationGoal::runChild): Call 'execve' only when
'sameOperatingSystemKernel' returns true.
| Ludovic Courtès |
| 2020-09-17 | guix-install.sh: Support OpenRC....* etc/guix-install.sh (chk_init_sys): Detect OpenRC.
(sys_enable_guix_daemon): Install & enable the Guix daemon on such
systems.
* etc/openrc/guix-daemon.in: New file.
* nix/local.mk: Add a rule for it.
(openrcservicedir, nodist_openrcservice_DATA): New variables.
(CLEANFILES, EXTRA_DIST): Add them.
* .gitignore: Ignore etc/openrc/guix-daemon.
Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
| Morgan Smith |
| 2020-09-14 | daemon: Spawn 'guix authenticate' once for all....Previously, we'd spawn 'guix authenticate' once for each item that has
to be signed (when exporting) or authenticated (when importing). Now,
we spawn it once for all and then follow a request/reply protocol. This
reduces the wall-clock time of:
guix archive --export -r $(guix build coreutils -d)
from 30s to 2s.
* guix/scripts/authenticate.scm (sign-with-key): Return the signature
instead of displaying it. Raise a &formatted-message instead of calling
'leave'.
(validate-signature): Likewise.
(read-command): New procedure.
(define-enumerate-type, reply-code): New macros.
(guix-authenticate)[send-reply]: New procedure.
Change to read commands from current-input-port.
* nix/libstore/local-store.cc (runAuthenticationProgram): Remove.
(authenticationAgent, readInteger, readAuthenticateReply): New
functions.
(signHash, verifySignature): Rewrite in terms of the agent.
* tests/store.scm ("import not signed"): Remove 'pk' call.
("import signed by unauthorized key"): Check the error message of C.
* tests/guix-authenticate.sh: Rewrite using the new protocol.
fixlet
| Ludovic Courtès |
| 2020-09-14 | daemon: Move 'Agent' to libutil....* nix/libstore/build.cc (DerivationGoal::tryBuildHook): Add "offload" to
'args' and pass settings.guixProgram as the first argument to
Agent::Agent.
(pathNullDevice, commonChildInit, Agent, Agent::Agent)
(Agent::~Agent): Move to...
* nix/libutil/util.cc: ... here.
* nix/libutil/util.hh (struct Agent, commonChildInit): New
declarations.
| Ludovic Courtès |
| 2020-09-14 | daemon: Isolate signing and signature verification functions....* nix/libstore/local-store.cc (signHash, verifySignature): New
functions.
(LocalStore::exportPath): Use 'signHash' instead of inline code.
(LocalStore::importPath): Use 'verifySignature' instead of inline code.
| Ludovic Courtès |
| 2020-09-14 | daemon: Generalize 'HookInstance' to 'Agent'....* nix/libstore/build.cc (HookInstance): Rename to...
(Agent): ... this. Rename 'toHook' and 'fromHook' similarly and update
users. Change constructor to require a command and an argument list.
(DerivationGoal::tryBuildHook): Pass arguments to the 'Agent'
constructor.
| Ludovic Courtès |
| 2020-09-11 | daemon: Simplify interface with 'guix authenticate'....There's no reason at this point to mimic the calling convention of the
'openssl' command.
* nix/libstore/local-store.cc (LocalStore::exportPath): Add only "sign"
and HASH to ARGS. Remove 'tmpDir' and 'hashFile'.
(LocalStore::importPath): Add only "verify" and SIGNATURE to
* guix/scripts/authenticate.scm (guix-authenticate): Adjust
accordingly; remove the OpenSSL-style clauses.
(read-hash-data): Remove.
(sign-with-key): Replace 'port' with 'sha256' and adjust accordingly.
(validate-signature): Export SIGNATURE to be a canonical sexp.
* tests/guix-authenticate.sh: Adjust tests accordingly.
| Ludovic Courtès |
| 2020-06-27 | daemon: Recognize SHA3 and BLAKE2s....* nix/libutil/hash.hh (HashType): Add htSHA3_256, htSHA3_512, and
htBLAKE2s_256.
* nix/libutil/hash.cc (parseHashType, printHashType): Recognize them.
* tests/store.scm ("add-to-store"): Test these algorithms.
| Ludovic Courtès |
