Commit graph

41 commits

Author SHA1 Message Date
Eelco Dolstra 0fdf4da0e9 Support cryptographically signed binary caches
NAR info files in binary caches can now have a cryptographic signature
that Nix will verify before using the corresponding NAR file.

To create a private/public key pair for signing and verifying a binary
cache, do:

  $ openssl genrsa -out ./cache-key.sec 2048
  $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub

You should also come up with a symbolic name for the key, such as
"cache.example.org-1".  This will be used by clients to look up the
public key.  (It's a good idea to number keys, in case you ever need
to revoke/replace one.)

To create a binary cache signed with the private key:

  $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1

The public key (cache-key.pub) should be distributed to the clients.
They should have a nix.conf should contain something like:

  signed-binary-caches = *
  binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub

If all works well, then if Nix fetches something from the signed
binary cache, you will see a message like:

  *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’...

On the other hand, if the signature is wrong, you get a message like

  NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring

Signatures are implemented as a single line appended to the NAR info
file, which looks like this:

  Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ==

Thus the signature has 3 fields: a version (currently "1"), the ID of
key, and the base64-encoded signature of the SHA-256 hash of the
contents of the NAR info file up to but not including the Signature
line.

Issue #75.
2014-01-08 15:42:53 +01:00
Eelco Dolstra 4b07476848 Prevent config.h from being clobbered 2013-03-08 01:27:04 +01:00
Eelco Dolstra bdd4646338 Revert "Prevent config.h from being clobbered"
This reverts commit 28bba8c44f.
2013-03-08 01:24:59 +01:00
Eelco Dolstra 28bba8c44f Prevent config.h from being clobbered 2013-03-07 23:55:55 +01:00
Eelco Dolstra 0a4e90395c Urgggh
http://hydra.nixos.org/build/3661100
2013-01-02 23:52:15 +01:00
Eelco Dolstra 46f852cda0 Use a GNU tar flag to shut up warnings about implausibly old timestamp 2012-08-01 16:42:51 -04:00
Eelco Dolstra 4911a10a4e Use XZ compression in binary caches
XZ compresses significantly better than bzip2.  Here are the
compression ratios and execution times (using 4 cores in parallel) on
my /var/run/current-system (3.1 GiB):

  bzip2: total compressed size 849.56 MiB, 30.8% [2m08]
  xz -6: total compressed size 641.84 MiB, 23.4% [6m53]
  xz -7: total compressed size 621.82 MiB, 22.6% [7m19]
  xz -8: total compressed size 599.33 MiB, 21.8% [7m18]
  xz -9: total compressed size 588.18 MiB, 21.4% [7m40]

Note that compression takes much longer.  More importantly, however,
decompression is much faster:

  bzip2: 1m47.274s
  xz -6: 0m55.446s
  xz -7: 0m54.119s
  xz -8: 0m52.388s
  xz -9: 0m51.842s

The only downside to using -9 is that decompression takes a fair
amount (~65 MB) of memory.
2012-06-29 15:24:52 -04:00
Eelco Dolstra 4f7bab7db1 Support building with the Perl XS bindings disabled
Since the Perl bindings require shared libraries, this is required on
platforms such as Cygwin where we do a static build.
2012-05-10 19:03:23 -04:00
Eelco Dolstra 969a14599d If "pv" is available at compile time, hard-code its path 2012-04-13 14:41:33 +02:00
Eelco Dolstra ea402a255f Replace "make check" with "make installcheck"
Ensuring that the tests work from the build tree requires a growing
number of nasty hacks.  The tests also don't verify that the installed
Nix actually works.  Thus, the tests now require "make install" to
have been run.
2012-03-19 01:20:02 +01:00
Eelco Dolstra b006a31d52 Drop the externals directory
Nix now requires SQLite and bzip2 to be pre-installed.  SQLite is
detected using pkg-config.  We required DBD::SQLite anyway, so
depending on SQLite is not a big problem.

The --with-bzip2, --with-openssl and --with-sqlite flags are gone.
2012-03-18 23:54:57 +01:00
Ludovic Courtès 6245f0d529 tests: Run `download-using-manifests' via libtool so that dlopening works. 2012-01-11 16:58:49 +00:00
Eelco Dolstra 6fcdbcac20 * Install NixManifest.pm, NixConfig.pm and GeneratePatches.pm under
the Nix:: namespace.
2011-10-10 21:11:08 +00:00
Eelco Dolstra 3cbf680f5d * configure: detect whether DBD::SQLite is present. If necessary the
location to DBI and DBD::SQLite can be passed with --with-dbi and
  --with-dbd-sqlite.
2011-04-11 10:13:53 +00:00
Eelco Dolstra fb9368b5a0 * Sync with the trunk. 2010-11-16 12:49:47 +00:00
Eelco Dolstra 36a23e86b6 * "type -P" isn't portable. 2010-10-04 15:50:08 +00:00
Eelco Dolstra aa45027818 * Sync with the trunk. 2010-05-12 22:13:09 +00:00
Eelco Dolstra f3b8833a48 * Drop the dependency on the ATerm library. 2010-04-19 14:51:58 +00:00
Eelco Dolstra 070057c1b9 * Sync with the trunk. 2010-03-11 10:52:52 +00:00
Eelco Dolstra 05fbf61f0e * nix-prefetch-url depends on sed (see
http://hydra.nixos.org/build/311170).
2010-03-05 18:26:47 +00:00
Eelco Dolstra bb82310dba * Set the path to sqlite3 properly. 2010-02-24 11:06:17 +00:00
Michael Raskin b4bc8b7616 --proxy=proxy:3128 2008-05-07 14:18:28 +00:00
Eelco Dolstra 658816ddc9 * Make really sure that we use bash. The line
NEED_PROG(shell, bash)

  actually uses the content of $shell if set, which often points at
  /bin/sh.
2008-04-10 09:54:23 +00:00
Eelco Dolstra 93aefd9fc0 * Give unpacked channels more sensible names than 0, 1, ... They now
get the basename of the channel URL (e.g., nixpkgs-unstable).  The
  top-level Nix expression of the channel is now an attribute set, the
  attributes of which are the individual channels (e.g.,
  {nixpkgs_unstable = ...; strategoxt_unstable = ...}).  This makes
  attribute paths ("nix-env -qaA" and "nix-env -iA") more sensible,
  e.g., "nix-env -iA nixpkgs_unstable.subversion".
2007-05-01 23:16:38 +00:00
Eelco Dolstra 9c3099d328 * Purify `make check'. 2006-07-21 13:21:43 +00:00
Eelco Dolstra 03162f8f47 * Unless --with-bzip2 is specified, use a copy of bzip2 in the
externals directory.  This is in particular useful because though
  most systems have bzip2/bunzip2, they don't always have libbz2,
  which we need for bsdiff/bspatch.
2006-04-25 10:45:53 +00:00
Eelco Dolstra e48bd8c8b5 * Add a test for nix-log2xml. 2006-03-01 13:25:08 +00:00
Eelco Dolstra a4c63c6e8e * Make it easy to run individual tests from the command line. 2006-03-01 12:15:33 +00:00
Eelco Dolstra 8291f6d968 * bsdiff updated to 4.3. This makes Nix depend on libbz2. 2006-02-01 16:48:49 +00:00
Eelco Dolstra bacd3a6cfa * Purify all corepkgs builders. 2005-03-15 12:03:15 +00:00
Eelco Dolstra a9858c9f26 * A test to verify that Nix executes build jobs in parallel, if
possible.

  This test fails right now because this hasn't been implemented right
  now.  Yes, I'm doing Test-Driven Development! ;-)
2004-05-04 17:04:17 +00:00
Eelco Dolstra 03f1d1ecb5 * Switched from wget to curl.
* Made the dependencies on bzip2 and the shell explicit.
2004-04-06 08:18:51 +00:00
Eelco Dolstra beda10f5a2 * Make perl a dependency of Nix. 2004-03-15 15:23:53 +00:00
Eelco Dolstra 7f0ed370da * Use $(storedir) instead of $(prefix)/store. 2004-02-20 11:32:30 +00:00
Eelco Dolstra 9ff3657095 * Generate RPM spec file. 2004-01-02 16:04:53 +00:00
Eelco Dolstra 68f2fadb78 * nix-pull requires libexecdir to be substituted. 2003-12-23 22:15:12 +00:00
Eelco Dolstra 5d2b424804 * Use a system name that does not include the OS manufacturer (i.e.,
"i686-linux" instead of "i686-suse-linux").
2003-12-01 14:36:50 +00:00
Eelco Dolstra 604c45e960 * Autoconf sucks. 2003-11-24 12:10:16 +00:00
Eelco Dolstra ab0bc4999a * Maintain integrity of the substitute and successor mappings when
deleting a path in the store.
* Allow absolute paths in Nix expressions.
* Get nix-prefetch-url to work again.
* Various other fixes.
2003-11-22 18:45:56 +00:00
Eelco Dolstra d551062ec4 * Scan for wget and use the full path in fetchurl.sh.
* Use nix-hash (not md5sum) in fetchurl.sh.
2003-08-06 09:35:05 +00:00
Eelco Dolstra 6f1a0f948d * Refactorings. 2003-07-20 19:29:38 +00:00