about summary refs log tree commit diff
path: root/substitute.mk
AgeCommit message (Collapse)AuthorFilesLines
2014-01-08 Support cryptographically signed binary cachesEelco Dolstra1-0/+1
NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-03-08 Prevent config.h from being clobberedEelco Dolstra1-0/+3
2013-03-08 Revert "Prevent config.h from being clobbered"Eelco Dolstra1-3/+0
This reverts commit 28bba8c44f484eae38e8a15dcec73cfa999156f6.
2013-03-07 Prevent config.h from being clobberedEelco Dolstra1-0/+3
2013-01-02 UrggghEelco Dolstra1-0/+1
http://hydra.nixos.org/build/3661100
2012-08-01 Use a GNU tar flag to shut up warnings about implausibly old timestampEelco Dolstra1-0/+1
2012-06-29 Use XZ compression in binary cachesEelco Dolstra1-0/+1
XZ compresses significantly better than bzip2. Here are the compression ratios and execution times (using 4 cores in parallel) on my /var/run/current-system (3.1 GiB): bzip2: total compressed size 849.56 MiB, 30.8% [2m08] xz -6: total compressed size 641.84 MiB, 23.4% [6m53] xz -7: total compressed size 621.82 MiB, 22.6% [7m19] xz -8: total compressed size 599.33 MiB, 21.8% [7m18] xz -9: total compressed size 588.18 MiB, 21.4% [7m40] Note that compression takes much longer. More importantly, however, decompression is much faster: bzip2: 1m47.274s xz -6: 0m55.446s xz -7: 0m54.119s xz -8: 0m52.388s xz -9: 0m51.842s The only downside to using -9 is that decompression takes a fair amount (~65 MB) of memory.
2012-05-10 Support building with the Perl XS bindings disabledEelco Dolstra1-0/+1
Since the Perl bindings require shared libraries, this is required on platforms such as Cygwin where we do a static build.
2012-04-13 If "pv" is available at compile time, hard-code its pathEelco Dolstra1-0/+1
2012-03-19 Replace "make check" with "make installcheck"Eelco Dolstra1-0/+1
Ensuring that the tests work from the build tree requires a growing number of nasty hacks. The tests also don't verify that the installed Nix actually works. Thus, the tests now require "make install" to have been run.
2012-03-18 Drop the externals directoryEelco Dolstra1-2/+1
Nix now requires SQLite and bzip2 to be pre-installed. SQLite is detected using pkg-config. We required DBD::SQLite anyway, so depending on SQLite is not a big problem. The --with-bzip2, --with-openssl and --with-sqlite flags are gone.
2012-01-11 tests: Run `download-using-manifests' via libtool so that dlopening works.Ludovic Courtès1-0/+2
2011-10-10 * Install NixManifest.pm, NixConfig.pm and GeneratePatches.pm underEelco Dolstra1-1/+1
the Nix:: namespace.
2011-04-11 * configure: detect whether DBD::SQLite is present. If necessary theEelco Dolstra1-0/+1
location to DBI and DBD::SQLite can be passed with --with-dbi and --with-dbd-sqlite.
2010-11-16 * Sync with the trunk.Eelco Dolstra1-1/+1
2010-10-04 * "type -P" isn't portable.Eelco Dolstra1-1/+1
2010-05-12 * Sync with the trunk.Eelco Dolstra1-1/+0
2010-04-19 * Drop the dependency on the ATerm library.Eelco Dolstra1-1/+0
2010-03-11 * Sync with the trunk.Eelco Dolstra1-0/+1
2010-03-05 * nix-prefetch-url depends on sed (seeEelco Dolstra1-0/+1
http://hydra.nixos.org/build/311170).
2010-02-24 * Set the path to sqlite3 properly.Eelco Dolstra1-0/+1
2008-05-07 --proxy=proxy:3128Michael Raskin1-0/+1
2008-04-10 * Make really sure that we use bash. The lineEelco Dolstra1-1/+1
NEED_PROG(shell, bash) actually uses the content of $shell if set, which often points at /bin/sh.
2007-05-01 * Give unpacked channels more sensible names than 0, 1, ... They nowEelco Dolstra1-0/+1
get the basename of the channel URL (e.g., nixpkgs-unstable). The top-level Nix expression of the channel is now an attribute set, the attributes of which are the individual channels (e.g., {nixpkgs_unstable = ...; strategoxt_unstable = ...}). This makes attribute paths ("nix-env -qaA" and "nix-env -iA") more sensible, e.g., "nix-env -iA nixpkgs_unstable.subversion".
2006-07-21 * Purify `make check'.Eelco Dolstra1-0/+1
2006-04-25 * Unless --with-bzip2 is specified, use a copy of bzip2 in theEelco Dolstra1-0/+1
externals directory. This is in particular useful because though most systems have bzip2/bunzip2, they don't always have libbz2, which we need for bsdiff/bspatch.
2006-03-01 * Add a test for nix-log2xml.Eelco Dolstra1-0/+3
2006-03-01 * Make it easy to run individual tests from the command line.Eelco Dolstra1-0/+2
2006-02-01 * bsdiff updated to 4.3. This makes Nix depend on libbz2.Eelco Dolstra1-2/+2
2005-03-15 * Purify all corepkgs builders.Eelco Dolstra1-0/+2
2004-05-04 * A test to verify that Nix executes build jobs in parallel, ifEelco Dolstra1-0/+1
possible. This test fails right now because this hasn't been implemented right now. Yes, I'm doing Test-Driven Development! ;-)
2004-04-06 * Switched from wget to curl.Eelco Dolstra1-1/+4
* Made the dependencies on bzip2 and the shell explicit.
2004-03-15 * Make perl a dependency of Nix.Eelco Dolstra1-0/+1
2004-02-20 * Use $(storedir) instead of $(prefix)/store.Eelco Dolstra1-0/+1
2004-01-02 * Generate RPM spec file.Eelco Dolstra1-1/+2
2003-12-23 * nix-pull requires libexecdir to be substituted.Eelco Dolstra1-0/+1
2003-12-01 * Use a system name that does not include the OS manufacturer (i.e.,Eelco Dolstra1-1/+1
"i686-linux" instead of "i686-suse-linux").
2003-11-24 * Autoconf sucks.Eelco Dolstra1-1/+1
2003-11-22 * Maintain integrity of the substitute and successor mappings whenEelco Dolstra1-5/+7
deleting a path in the store. * Allow absolute paths in Nix expressions. * Get nix-prefetch-url to work again. * Various other fixes.
2003-08-06 * Scan for wget and use the full path in fetchurl.sh.Eelco Dolstra1-0/+1
* Use nix-hash (not md5sum) in fetchurl.sh.
2003-07-20 * Refactorings.Eelco Dolstra1-0/+8