1 files changed, 18 insertions, 6 deletions

diff --git a/scripts/download-from-binary-cache.pl.in b/scripts/download-from-binary-cache.pl.in
index 950bcd178527..e6925d7316d0 100644
--- a/scripts/download-from-binary-cache.pl.in
+++ b/scripts/download-from-binary-cache.pl.in
@@ -42,6 +42,8 @@ my $caBundle = $ENV{"CURL_CA_BUNDLE"} // $ENV{"OPENSSL_X509_CERT_FILE"};
 
 my $userName = getpwuid($<) or die "cannot figure out user name";
 
+my $requireSignedBinaryCaches = ($Nix::Config::config{"signed-binary-caches"} // "0") ne "0";
+
 
 sub addRequest {
     my ($storePath, $url, $head) = @_;
@@ -120,9 +122,10 @@ sub processRequests {
 
 
 sub initCache {
-    my $dbPath = "$Nix::Config::stateDir/binary-cache-v2.sqlite";
+    my $dbPath = "$Nix::Config::stateDir/binary-cache-v3.sqlite";
 
     unlink "$Nix::Config::stateDir/binary-cache-v1.sqlite";
+    unlink "$Nix::Config::stateDir/binary-cache-v2.sqlite";
 
     # Open/create the database.
     $dbh = DBI->connect("dbi:SQLite:dbname=$dbPath", "", "")
@@ -159,7 +162,7 @@ EOF
             narSize          integer,
             refs             text,
             deriver          text,
-            system           text,
+            signedBy         text,
             timestamp        integer not null,
             primary key (cache, storePath),
             foreign key (cache) references BinaryCaches(id) on delete cascade
@@ -183,7 +186,7 @@ EOF
 
     $insertNAR = $dbh->prepare(
         "insert or replace into NARs(cache, storePath, url, compression, fileHash, fileSize, narHash, " .
-        "narSize, refs, deriver, system, timestamp) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)") or die;
+        "narSize, refs, deriver, signedBy, timestamp) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)") or die;
 
     $queryNAR = $dbh->prepare("select * from NARs where cache = ? and storePath = ?") or die;
 
@@ -309,14 +312,16 @@ sub processNARInfo {
         return undef;
     }
 
-    my $narInfo = parseNARInfo($storePath, $request->{content});
+    my $narInfo = parseNARInfo($storePath, $request->{content}, $requireSignedBinaryCaches, $request->{url});
     return undef unless defined $narInfo;
 
+    die if $requireSignedBinaryCaches && !defined $narInfo->{signedBy};
+
     # Cache the result.
     $insertNAR->execute(
         $cache->{id}, basename($storePath), $narInfo->{url}, $narInfo->{compression},
         $narInfo->{fileHash}, $narInfo->{fileSize}, $narInfo->{narHash}, $narInfo->{narSize},
-        join(" ", @{$narInfo->{refs}}), $narInfo->{deriver}, $narInfo->{system}, time())
+        join(" ", @{$narInfo->{refs}}), $narInfo->{deriver}, $narInfo->{signedBy}, time())
         if shouldCache $request->{url};
 
     return $narInfo;
@@ -330,6 +335,10 @@ sub getCachedInfoFrom {
     my $res = $queryNAR->fetchrow_hashref();
     return undef unless defined $res;
 
+    # We may previously have cached this info when signature checking
+    # was disabled.  In that case, ignore the cached info.
+    return undef if $requireSignedBinaryCaches && !defined $res->{signedBy};
+
     return
         { url => $res->{url}
         , compression => $res->{compression}
@@ -339,6 +348,7 @@ sub getCachedInfoFrom {
         , narSize => $res->{narSize}
         , refs => [ split " ", $res->{refs} ]
         , deriver => $res->{deriver}
+        , signedBy => $res->{signedBy}
         } if defined $res;
 }
 
@@ -522,7 +532,8 @@ sub downloadBinary {
             next;
         }
         my $url = "$cache->{url}/$info->{url}"; # FIXME: handle non-relative URLs
-        print STDERR "\n*** Downloading ‘$url’ to ‘$storePath’...\n";
+        die if $requireSignedBinaryCaches && !defined $info->{signedBy};
+        print STDERR "\n*** Downloading ‘$url’ ", ($requireSignedBinaryCaches ? "(signed by ‘$info->{signedBy}’) " : ""), "to ‘$storePath’...\n";
         checkURL $url;
         if (system("$Nix::Config::curl --fail --location --insecure '$url' $decompressor | $Nix::Config::binDir/nix-store --restore $destPath") != 0) {
             warn "download of `$url' failed" . ($! ? ": $!" : "") . "\n";
@@ -530,6 +541,7 @@ sub downloadBinary {
         }
 
         # Tell Nix about the expected hash so it can verify it.
+        die unless defined $info->{narHash} && $info->{narHash} ne "";
         print "$info->{narHash}\n";
 
         print STDERR "\n";