mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: fetch the swarm signature from attic before verifying a locally valid closure

Browse source
This commit is contained in:
atlas 2026-11-08 11:45:20 +01:00
commit c25cf3d48a
1 changed files with 393 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/4-implementation/swarm/builder.md
View file

@ -609,7 +609,12 @@ refusal and a path no substituter has each fail with their own message.
`Swap` then does the same lookup and pull, a no-op once the path is in the
store, and gives `hive-priv` the store path to apply. `hive-priv` applies it only
when `nix store verify --sigs-needed 1` finds the swarm key's signature on it. A stopped agent skips
when `nix store verify --sigs-needed 1` finds the swarm key's signature on it.
A path that was already in the store, such as one the builder built through the
host's daemon, carries no signature there, and the pull leaves it so, so
`hive-priv` first runs `nix store copy-sigs` for that one path against the
cache in `/run/hyperhive-nix/cache.conf` (netrc `/run/hyperhive-nix/netrc`). The
verify still needs the swarm key's signature; a failed copy only gets logged. A stopped agent skips
`Prebuild`, so `Swap` downloads it. A first deploy's `Create` node does the
same and creates the container from that path.