# -*- coding: utf-8 -*-
# GNU Guix --- Functional package management for GNU
# Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

import os
import site
import sys

# Commentary:
#
# Site-specific customization for Guix.
#
# The program below honors the GUIX_PYTHONPATH environment variable to
# discover Python packages.  File names appearing in this variable that match
# a predefined versioned installation prefix are added to the sys.path.  To be
# considered, a Python package must be installed under the
# 'lib/pythonX.Y/site-packages' directory, where X and Y are the major and
# minor version numbers of the Python interpreter.
#
# Code:

major_minor = '{}.{}'.format(*sys.version_info)
site_packages_prefix = os.path.join(
    'lib', 'python' + major_minor, 'site-packages')
python_site = os.path.join(sys.prefix, site_packages_prefix)

try:
    all_sites_raw = os.environ['GUIX_PYTHONPATH'].split(os.path.pathsep)
except KeyError:
    all_sites_raw = []
# Normalize paths, otherwise a trailing slash would cause it to not match.
all_sites_norm = [os.path.normpath(p) for p in all_sites_raw]
matching_sites = [p for p in all_sites_norm
                  if p.endswith(site_packages_prefix)]

if matching_sites:
    # Deduplicate the entries, append them to sys.path, and handle any
    # .pth files they contain.
    for s in matching_sites:
        site.addsitedir(s)

    # Move the entries that were appended to sys.path in front of
    # Python's own site-packages directory.  This enables Guix
    # packages to override Python's bundled packages, such as 'pip'.
    python_site_index = sys.path.index(python_site)
    new_site_start_index = sys.path.index(matching_sites[0])
    if python_site_index < new_site_start_index:
        sys.path = (sys.path[:python_site_index]
                    + sys.path[new_site_start_index:]
                    + sys.path[python_site_index:new_site_start_index])
Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2021-12-22 10:53:19 +0100'>2021-12-22</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=9ebc9ca070a21ba0aeb3f61202a8071bb250ccc8'>tests: Move keys into ./tests/keys/ and add a third ed25519 key.</a><span class='msg-avail'>...<span class='msg-tooltip'>The third key will be used in an upcoming commit.

Rename public keys to .pub.

* guix/tests/gnupg.scm (%ed25519-3-public-key-file): New variable.
(%ed25519-3-secret-key-file): New variable.
(%ed25519-2-public-key-file): Renamed from %ed25519bis-public-key-file.
(%ed25519-2-secret-key-file): Renamed from %ed25519bis-secret-key-file.
* tests/keys/ed25519-3.key: New file.
* tests/keys/ed25519-3.sec: New file.

Signed-off-by: Mathieu Othacehe &lt;othacehe@gnu.org&gt;
</span></span></td><td>Attila Lendvai</td></tr>
<tr><td><span title='2020-09-15 14:40:20 +0200'>2020-09-15</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=b911d6547444b5f8d17b224bafa5ee1b5aafaff5'>authenticate: Encode strings as ISO-8859-1.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/43421&gt;.

* guix/scripts/authenticate.scm (read-command): Decode strings as
ISO-8859-1, not UTF-8.
(guix-authenticate)[send-reply]: Encode strings as ISO-8859-1, not
UTF-8.
* tests/guix-authenticate.sh: Add test.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-14 15:42:55 +0200'>2020-09-14</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=64cf660f872fb7aaf0d2b463e45b4c756297f743'>daemon: Spawn 'guix authenticate' once for all.</a><span class='msg-avail'>...<span class='msg-tooltip'>Previously, we'd spawn 'guix authenticate' once for each item that has
to be signed (when exporting) or authenticated (when importing).  Now,
we spawn it once for all and then follow a request/reply protocol.  This
reduces the wall-clock time of:

  guix archive --export -r $(guix build coreutils -d)

from 30s to 2s.

* guix/scripts/authenticate.scm (sign-with-key): Return the signature
instead of displaying it.  Raise a &amp;formatted-message instead of calling
'leave'.
(validate-signature): Likewise.
(read-command): New procedure.
(define-enumerate-type, reply-code): New macros.
(guix-authenticate)[send-reply]: New procedure.
Change to read commands from current-input-port.
* nix/libstore/local-store.cc (runAuthenticationProgram): Remove.
(authenticationAgent, readInteger, readAuthenticateReply): New
functions.
(signHash, verifySignature): Rewrite in terms of the agent.
* tests/store.scm ("import not signed"): Remove 'pk' call.
("import signed by unauthorized key"): Check the error message of C.
* tests/guix-authenticate.sh: Rewrite using the new protocol.

fixlet
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-11 17:53:58 +0200'>2020-09-11</span></td><td><a href='/guix/commit/tests/guix-authenticate.sh?id=6dd8ffc57420ee2f6f19e79e41028e78fe9e6a7e'>daemon: Simplify interface with 'guix authenticate'.</a><span class='msg-avail'>...<span class='msg-tooltip'>There's no reason at this point to mimic the calling convention of the
'openssl' command.

* nix/libstore/local-store.cc (LocalStore::exportPath): Add only "sign"
and HASH to ARGS.  Remove 'tmpDir' and 'hashFile'.
(LocalStore::importPath): Add only "verify" and SIGNATURE to
* guix/scripts/authenticate.scm (guix-authenticate): Adjust
accordingly; remove the OpenSSL-style clauses.
(read-hash-data): Remove.
(sign-with-key): Replace 'port' with 'sha256' and adjust accordingly.
(validate-signature): Export SIGNATURE to be a canonical sexp.
* tests/guix-authenticate.sh: Adjust tests accordingly.
</span></span></td><td>Ludovic Courtès</td></tr>