depot - monorepo for the virus lounge

Age	Commit message (Collapse)	Author	Files	Lines
2014-01-08	Fix signed-binary-caches test	Eelco Dolstra	1	-1/+4

2014-01-08	Test whether Nix correctly checks the hash of downloaded NARs	Eelco Dolstra	1	-0/+14

2014-01-08	Support cryptographically signed binary caches	Eelco Dolstra	1	-0/+8
	NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-07-01	Add support for uncompressed NARs in binary caches	Eelco Dolstra	1	-1/+1
	Issue NixOS/hydra#102.
2013-04-23	Test whether --fallback works if NARS have disappeared from the binary cache	Eelco Dolstra	1	-0/+14

2013-04-23	Test NAR info caching	Eelco Dolstra	1	-1/+3

2013-01-02	If a substitute closure is incomplete, build dependencies, then retry the ↵	Eelco Dolstra	1	-1/+2
	substituter Issue #77.
2013-01-02	Add a test for incomplete closures in the binary cache	Eelco Dolstra	1	-0/+8
	Issue #77.
2012-12-03	Test the ‘--prebuilt-only’ flag	Eelco Dolstra	1	-0/+3

2012-09-12	Fix test failure on Darwin	Eelco Dolstra	1	-0/+1
	Apparently our DBD::SQLite links against /usr/lib/libsqlite3.dylib, which is an old version that doesn't respect foreign key constraints. So manifests/cache.sqlite doesn't get updated properly when a manifest disappears. We should fix our DBD::SQLite, but in the meantime this will fix the test. http://hydra.nixos.org/build/3017959
2012-07-30	Fix the test	Eelco Dolstra	1	-4/+4

2012-07-27	Allow a binary cache to declare that it doesn't support "nix-env -qas"	Eelco Dolstra	1	-1/+14
	Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27	Test "nix-env -qas" with the binary cache substituter	Eelco Dolstra	1	-1/+4

2012-07-26	Add a test for the binary cache substituter	Eelco Dolstra	1	-0/+19