mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: fetch the swarm signature from attic before verifying a locally valid closure

Browse source
This commit is contained in:
atlas 2026-11-08 11:45:20 +01:00
commit c25cf3d48a
1 changed files with 393 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-priv/README.md
View file

@ -47,7 +47,9 @@ Each module's `//!` header lists its ops.
`container_toplevel_action` (in `src/container.rs`) applies a closure that is
already in the store; hive-priv builds nothing. hive-c0re names the closure
(`toplevel` on `CreateContainer` / `UpdateContainer`), pulled beforehand by
hive-c0re through the nix daemon. hive-priv applies a path only when
hive-c0re through the nix daemon. hive-priv first imports the cache's signature for the path with
`nix store copy-sigs` (from `/run/hyperhive-nix/cache.conf`; a failure logs a
warning), then applies it only when
`nix store verify --no-contents --sigs-needed 1`, with the key in root-owned
`/run/hyperhive-priv/attic/public-key`, finds the swarm cache's signature on it.
It refuses a path that is absent, unsigned, signed by another key or not a store