# GNU Guix --- Functional package management for GNU
# Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

#
# Test the 'guix authenticate' command-line utility.
#

guix authenticate --version

sig="t-signature-$$"
hash="t-hash-$$"
rm -f "$sig" "$hash"

trap 'rm -f "$sig" "$hash"' EXIT

# A hexadecimal string as long as a sha256 hash.
echo "2749f0ea9f26c6c7be746a9cff8fa4c2f2a02b000070dba78429e9a11f87c6eb" \
    > "$hash"

guix authenticate rsautl -sign				\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
    -in "$hash" > "$sig"
test -f "$sig"

hash2="`guix authenticate rsautl -verify		\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin -in $sig`"
test "$hash2" = `cat "$hash"`

# Same thing in a pipeline, using the command line syntax that Nix/Crypto.pm
# uses.
hash2="`						\
  cat "$hash"						\
  | guix authenticate rsautl -sign			\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
  | guix authenticate rsautl -verify			\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin`"
test "$hash2" = `cat "$hash"`

# Detect corrupt signatures.
if guix authenticate rsautl -verify				\
          -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
          -pubin -in /dev/null
then false
else true
fi

# Detect invalid signatures.
# The signature has (payload (data ... (hash sha256 #...#))).  We proceed by
# modifying this hash.
sed -i "$sig"											\
    -e's|#[A-Z0-9]\{64\}#|#0000000000000000000000000000000000000000000000000000000000000000#|g'
if guix authenticate rsautl -verify				\
          -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
          -pubin -in "$sig"
then false
else true
fi


# Test for <http://bugs.gnu.org/17312>: make sure 'guix authenticate' produces
# valid signatures when run in the C locale.
echo "5eff0b55c9c5f5e87b4e34cd60a2d5654ca1eb78c7b3c67c3179fed1cff07b4c" \
    > "$hash"

LC_ALL=C
export LC_ALL

guix authenticate rsautl -sign				\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
    -in "$hash" > "$sig"

guix authenticate rsautl -verify			\
        -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
        -pubin -in "$sig"
hash2="`guix authenticate rsautl -verify		\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin -in $sig`"
test "$hash2" = `cat "$hash"`
file.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/pull.scm (%pull-version): New variable.
(build-from-source): Pass #:pull-version to BUILD.
(whole-package-for-legacy, derivation-&gt;manifest-entry): New procedure.
(build-and-install): Rewrite in terms of 'build-and-use-profile'.
* guix/scripts/system.scm (maybe-suggest-running-guix-pull)[latest]:
Switch to "/current".
* scripts/guix.in (augment-load-paths!): Remove use of
~/.config/guix/latest.
* build-aux/compile-as-derivation.scm: Replace "/guix/latest/" with
"/current/share/guile/site/X.Y"
* guix/scripts.scm (warn-about-old-distro)[age]: Check "/current"
instead of "/latest".
* doc/guix.texi (Invoking guix pull): Document it.
* doc/contributing.texi (Running Guix Before It Is Installed): Remove
footnote about abusing ~/.config/guix/latest.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-01-28 23:14:55 +0100'>2018-01-28</span></td><td><a href='/guix/commit/scripts?id=63666a348af5ef5190cbe9611c40f2b9188b7967'>guix: Let Emacs detect “scripts/guix.in” appropriate mode.</a><span class='msg-avail'>...<span class='msg-tooltip'>Since commit 6f774d481839f87178c5895ac2d661e141f879b8 which introduces the use
of Guile's meta switch in “scripts/guix.in”, Emacs was not using ‘scheme-mode’
for this file.

* scripts/guix.in: Replace "-*- scheme -*-" with a local variable.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Mathieu Lirzin</td></tr>
<tr><td><span title='2018-01-23 15:01:15 +0100'>2018-01-23</span></td><td><a href='/guix/commit/scripts?id=6f774d481839f87178c5895ac2d661e141f879b8'>guix: Refactor script.</a><span class='msg-avail'>...<span class='msg-tooltip'>* scripts/guix.in: Remove empty surrounding ‘let’.  Define 'main' as the
procedure called when running the script.
(maybe-augment-load-paths!): Rename to ...
(augment-load-paths!): ... this.  Use 'and=&gt;' for 'file-exists?'.
(run-guix-main): Rename to ...
(main): ... this.  Call 'augment-load-paths!'.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Mathieu Lirzin</td></tr>
<tr><td><span title='2018-01-23 10:13:16 +0100'>2018-01-23</span></td><td><a href='/guix/commit/scripts?id=cba386c1295b7054df22dfb4662b1b92f668e2c0'>build: Expand ‘scripts/guix’ at Make time.</a><span class='msg-avail'>...<span class='msg-tooltip'>This moves the complexity of Autotools variable expansion outside of the
application code.

* scripts/guix.in (config-lookup): Delete.
(maybe-augment-load-paths!, run-guix-main): Use fully expanded variables
instead of calling ‘config-lookup’.
* configure.ac: Don't use AC_CONFIG_FILES for ‘scripts/guix’.
Use AC_PROG_SED.
* Makefile.am (scripts/guix): New rule.
(do_subst): New variable.
(CLEANFILES, EXTRA_DIST): Adapt.

Co-authored-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Mathieu Lirzin</td></tr>