depot - monorepo for the virus lounge

Age	Commit message (Collapse)	Author	Files	Lines
2016-06-01	HttpBinaryCacheStore: Fix caching of WantMassQuery	Eelco Dolstra	1	-18/+34
	Also, test HttpBinaryCacheStore in addition to LocalBinaryCacheStore.
2016-05-30	Test trying the next substitute after a bad signature	Eelco Dolstra	1	-2/+10

2016-05-30	Test the NAR info cache	Eelco Dolstra	1	-9/+6

2016-05-30	Re-implement binary cache signature checking	Eelco Dolstra	1	-1/+1
	This is now done in LocalStore::addToStore(), rather than in the binary cache substituter (which no longer exists).
2016-05-30	LocalStore::addToStore: Verify hash of the imported path	Eelco Dolstra	1	-1/+1

2016-04-11	Remove manifest support	Eelco Dolstra	1	-1/+0
	Manifests have been superseded by binary caches for years. This also gets rid of nix-pull, nix-generate-patches and bsdiff/bspatch.
2015-02-18	nix-store --generate-binary-cache-key: Write key to disk	Eelco Dolstra	1	-9/+7
	This ensures proper permissions for the secret key.
2015-02-10	Make libsodium an optional dependency	Eelco Dolstra	1	-0/+4

2015-02-04	Use libsodium instead of OpenSSL for binary cache signing	Eelco Dolstra	1	-0/+50
	Sodium's Ed25519 signatures are much shorter than OpenSSL's RSA signatures. Public keys are also much shorter, so they're now specified directly in the nix.conf option ‘binary-cache-public-keys’. The new command ‘nix-store --generate-binary-cache-key’ generates and prints a public and secret key.
2014-02-26	Test executables in NARs	Eelco Dolstra	1	-0/+2

2014-02-17	Add a test for repairing paths	Eelco Dolstra	1	-3/+1

2014-01-08	Fix signed-binary-caches test	Eelco Dolstra	1	-1/+4

2014-01-08	Test whether Nix correctly checks the hash of downloaded NARs	Eelco Dolstra	1	-0/+14

2014-01-08	Support cryptographically signed binary caches	Eelco Dolstra	1	-0/+8
	NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-07-01	Add support for uncompressed NARs in binary caches	Eelco Dolstra	1	-1/+1
	Issue NixOS/hydra#102.
2013-04-23	Test whether --fallback works if NARS have disappeared from the binary cache	Eelco Dolstra	1	-0/+14

2013-04-23	Test NAR info caching	Eelco Dolstra	1	-1/+3

2013-01-02	If a substitute closure is incomplete, build dependencies, then retry the ↵	Eelco Dolstra	1	-1/+2
	substituter Issue #77.
2013-01-02	Add a test for incomplete closures in the binary cache	Eelco Dolstra	1	-0/+8
	Issue #77.
2012-12-03	Test the ‘--prebuilt-only’ flag	Eelco Dolstra	1	-0/+3

2012-09-12	Fix test failure on Darwin	Eelco Dolstra	1	-0/+1
	Apparently our DBD::SQLite links against /usr/lib/libsqlite3.dylib, which is an old version that doesn't respect foreign key constraints. So manifests/cache.sqlite doesn't get updated properly when a manifest disappears. We should fix our DBD::SQLite, but in the meantime this will fix the test. http://hydra.nixos.org/build/3017959
2012-07-30	Fix the test	Eelco Dolstra	1	-4/+4

2012-07-27	Allow a binary cache to declare that it doesn't support "nix-env -qas"	Eelco Dolstra	1	-1/+14
	Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27	Test "nix-env -qas" with the binary cache substituter	Eelco Dolstra	1	-1/+4

2012-07-26	Add a test for the binary cache substituter	Eelco Dolstra	1	-0/+19