about summary refs log tree commit diff
path: root/tests/binary-cache.sh
AgeCommit message (Collapse)AuthorFilesLines
2017-10-02 Fix testsDan Peebles1-2/+2
`nix copy` no longer accepts a `--recursive` argument
2017-03-21 Fix tests to reflect the signed-binary-caches default changeEelco Dolstra1-5/+5
2016-08-10 Nuke nix-push.Shea Levy1-3/+3
Rarely used, nix copy replaces it.
2016-06-01 HttpBinaryCacheStore: Fix caching of WantMassQueryEelco Dolstra1-18/+34
Also, test HttpBinaryCacheStore in addition to LocalBinaryCacheStore.
2016-05-30 Test trying the next substitute after a bad signatureEelco Dolstra1-2/+10
2016-05-30 Test the NAR info cacheEelco Dolstra1-9/+6
2016-05-30 Re-implement binary cache signature checkingEelco Dolstra1-1/+1
This is now done in LocalStore::addToStore(), rather than in the binary cache substituter (which no longer exists).
2016-05-30 LocalStore::addToStore: Verify hash of the imported pathEelco Dolstra1-1/+1
2016-04-11 Remove manifest supportEelco Dolstra1-1/+0
Manifests have been superseded by binary caches for years. This also gets rid of nix-pull, nix-generate-patches and bsdiff/bspatch.
2015-02-18 nix-store --generate-binary-cache-key: Write key to diskEelco Dolstra1-9/+7
This ensures proper permissions for the secret key.
2015-02-10 Make libsodium an optional dependencyEelco Dolstra1-0/+4
2015-02-04 Use libsodium instead of OpenSSL for binary cache signingEelco Dolstra1-0/+50
Sodium's Ed25519 signatures are much shorter than OpenSSL's RSA signatures. Public keys are also much shorter, so they're now specified directly in the nix.conf option ‘binary-cache-public-keys’. The new command ‘nix-store --generate-binary-cache-key’ generates and prints a public and secret key.
2014-02-26 Test executables in NARsEelco Dolstra1-0/+2
2014-02-17 Add a test for repairing pathsEelco Dolstra1-3/+1
2014-01-08 Fix signed-binary-caches testEelco Dolstra1-1/+4
2014-01-08 Test whether Nix correctly checks the hash of downloaded NARsEelco Dolstra1-0/+14
2014-01-08 Support cryptographically signed binary cachesEelco Dolstra1-0/+8
NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-07-01 Add support for uncompressed NARs in binary cachesEelco Dolstra1-1/+1
Issue NixOS/hydra#102.
2013-04-23 Test whether --fallback works if NARS have disappeared from the binary cacheEelco Dolstra1-0/+14
2013-04-23 Test NAR info cachingEelco Dolstra1-1/+3
2013-01-02 If a substitute closure is incomplete, build dependencies, then retry the ↵Eelco Dolstra1-1/+2
substituter Issue #77.
2013-01-02 Add a test for incomplete closures in the binary cacheEelco Dolstra1-0/+8
Issue #77.
2012-12-03 Test the ‘--prebuilt-only’ flagEelco Dolstra1-0/+3
2012-09-12 Fix test failure on DarwinEelco Dolstra1-0/+1
Apparently our DBD::SQLite links against /usr/lib/libsqlite3.dylib, which is an old version that doesn't respect foreign key constraints. So manifests/cache.sqlite doesn't get updated properly when a manifest disappears. We should fix our DBD::SQLite, but in the meantime this will fix the test. http://hydra.nixos.org/build/3017959
2012-07-30 Fix the testEelco Dolstra1-4/+4
2012-07-27 Allow a binary cache to declare that it doesn't support "nix-env -qas"Eelco Dolstra1-1/+14
Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27 Test "nix-env -qas" with the binary cache substituterEelco Dolstra1-1/+4
2012-07-26 Add a test for the binary cache substituterEelco Dolstra1-0/+19