diff options
| -rw-r--r-- | src/nix-store/nix-store.cc | 12 | ||||
| -rw-r--r-- | tests/binary-cache.sh | 16 |
2 files changed, 15 insertions, 13 deletions
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc index c16adf049628..7ce5f63c2d2f 100644 --- a/src/nix-store/nix-store.cc +++ b/src/nix-store/nix-store.cc @@ -1015,8 +1015,11 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs) foreach (Strings::iterator, i, opFlags) throw UsageError(format("unknown flag ‘%1%’") % *i); - if (opArgs.size() != 1) throw UsageError("one argument expected"); - string keyName = opArgs.front(); + if (opArgs.size() != 3) throw UsageError("three arguments expected"); + auto i = opArgs.begin(); + string keyName = *i++; + string secretKeyFile = *i++; + string publicKeyFile = *i++; #if HAVE_SODIUM sodium_init(); @@ -1026,8 +1029,9 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs) if (crypto_sign_keypair(pk, sk) != 0) throw Error("key generation failed"); - std::cout << keyName << ":" << base64Encode(string((char *) pk, crypto_sign_PUBLICKEYBYTES)) << std::endl; - std::cout << keyName << ":" << base64Encode(string((char *) sk, crypto_sign_SECRETKEYBYTES)) << std::endl; + writeFile(publicKeyFile, keyName + ":" + base64Encode(string((char *) pk, crypto_sign_PUBLICKEYBYTES))); + umask(0077); + writeFile(secretKeyFile, keyName + ":" + base64Encode(string((char *) sk, crypto_sign_SECRETKEYBYTES))); #else throw Error("Nix was not compiled with libsodium, required for signed binary cache support"); #endif diff --git a/tests/binary-cache.sh b/tests/binary-cache.sh index 753c2c466e6d..c72d2defa5d0 100644 --- a/tests/binary-cache.sh +++ b/tests/binary-cache.sh @@ -94,18 +94,16 @@ if [ -n "$HAVE_SODIUM" ]; then # Create a signed binary cache. clearCache -declare -a res=($(nix-store --generate-binary-cache-key test.nixos.org-1)) -publicKey="${res[0]}" -secretKey="${res[1]}" -echo "$secretKey" > $TEST_ROOT/secret-key +declare -a res=($(nix-store --generate-binary-cache-key test.nixos.org-1 $TEST_ROOT/sk1 $TEST_ROOT/pk1 )) +publicKey="$(cat $TEST_ROOT/pk1)" -res=($(nix-store --generate-binary-cache-key test.nixos.org-1)) -badKey="${res[0]}" +res=($(nix-store --generate-binary-cache-key test.nixos.org-1 $TEST_ROOT/sk2 $TEST_ROOT/pk2)) +badKey="$(cat $TEST_ROOT/pk2)" -res=($(nix-store --generate-binary-cache-key foo.nixos.org-1)) -otherKey="${res[0]}" +res=($(nix-store --generate-binary-cache-key foo.nixos.org-1 $TEST_ROOT/sk3 $TEST_ROOT/pk3)) +otherKey="$(cat $TEST_ROOT/pk3)" -nix-push --dest $cacheDir --key-file $TEST_ROOT/secret-key $outPath +nix-push --dest $cacheDir --key-file $TEST_ROOT/sk1 $outPath # Downloading should fail if we don't provide a key. |