nix verify-paths: Add ‘--sigs-needed <N>’ flag

This specifies the number of distinct signatures required to consider
each path "trusted".

Also renamed ‘--no-sigs’ to ‘--no-trust’ for the flag that disables
verifying whether a path is trusted (since a path can also be trusted
if it has no signatures, but was built locally).

1 files changed, 7 insertions, 1 deletions

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index b9939feda477..cc91ed287768 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -333,12 +333,18 @@ unsigned int ValidPathInfo::checkSignatures(const PublicKeys & publicKeys) const
 {
     unsigned int good = 0;
     for (auto & sig : sigs)
-        if (verifyDetached(fingerprint(), sig, publicKeys))
+        if (checkSignature(publicKeys, sig))
             good++;
     return good;
 }
 
 
+bool ValidPathInfo::checkSignature(const PublicKeys & publicKeys, const std::string & sig) const
+{
+    return verifyDetached(fingerprint(), sig, publicKeys);
+}
+
+
 }