diff options
-rw-r--r-- | src/libstore/build.cc | 3 | ||||
-rw-r--r-- | src/libstore/local-store.cc | 16 | ||||
-rw-r--r-- | src/libstore/local-store.hh | 6 |
3 files changed, 24 insertions, 1 deletions
diff --git a/src/libstore/build.cc b/src/libstore/build.cc index 31c321c83ade..1a51d0ec402d 100644 --- a/src/libstore/build.cc +++ b/src/libstore/build.cc @@ -2748,6 +2748,7 @@ void DerivationGoal::registerOutputs() trusted. */ if (!info.ultimate) { info.ultimate = true; + worker.store.signPathInfo(info); worker.store.registerValidPaths({info}); } @@ -2808,6 +2809,8 @@ void DerivationGoal::registerOutputs() info.references = references; info.deriver = drvPath; info.ultimate = true; + worker.store.signPathInfo(info); + infos.push_back(info); } diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc index 28e340af7a5e..713ff49be6cf 100644 --- a/src/libstore/local-store.cc +++ b/src/libstore/local-store.cc @@ -310,7 +310,7 @@ void LocalStore::openDB(bool create) /* Prepare SQL statements. */ stmtRegisterValidPath.create(db, - "insert into ValidPaths (path, hash, registrationTime, deriver, narSize, ultimate) values (?, ?, ?, ?, ?, ?);"); + "insert into ValidPaths (path, hash, registrationTime, deriver, narSize, ultimate, sigs) values (?, ?, ?, ?, ?, ?, ?);"); stmtUpdatePathInfo.create(db, "update ValidPaths set narSize = ?, hash = ?, ultimate = ?, sigs = ? where path = ?;"); stmtAddReference.create(db, @@ -547,6 +547,7 @@ uint64_t LocalStore::addValidPath(const ValidPathInfo & info, bool checkOutputs) (info.deriver, info.deriver != "") (info.narSize, info.narSize != 0) (info.ultimate ? 1 : 0, info.ultimate) + (concatStringsSep(" ", info.sigs), !info.sigs.empty()) .exec(); uint64_t id = sqlite3_last_insert_rowid(db); @@ -1710,4 +1711,17 @@ void LocalStore::addSignatures(const Path & storePath, const StringSet & sigs) } +void LocalStore::signPathInfo(ValidPathInfo & info) +{ + // FIXME: keep secret keys in memory. + + auto secretKeyFiles = settings.get("secret-key-files", Strings()); + + for (auto & secretKeyFile : secretKeyFiles) { + SecretKey secretKey(readFile(secretKeyFile)); + info.sign(secretKey); + } +} + + } diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh index ec8146e68b79..615e3d76c754 100644 --- a/src/libstore/local-store.hh +++ b/src/libstore/local-store.hh @@ -301,6 +301,12 @@ private: // Internal versions that are not wrapped in retry_sqlite. bool isValidPath_(const Path & path); void queryReferrers_(const Path & path, PathSet & referrers); + + /* Add signatures to a ValidPathInfo using the secret keys + specified by the ‘secret-key-files’ option. */ + void signPathInfo(ValidPathInfo & info); + + friend class DerivationGoal; }; |