mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: fetch the swarm signature from attic before verifying a locally valid closure

Browse source
This commit is contained in:
atlas 2026-11-08 11:45:20 +01:00
commit c25cf3d48a
1 changed files with 393 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

44
nix/script-tests/cache-pull-substitute.sh
View file

@ -8,6 +8,11 @@
# holds the dependency. The stores are chroot stores, so the realise runs in
# this process where a host runs it in the daemon; the substitution logic is
# the same.
#
# The last cases are hive-priv's step before its `nix store verify`
# (hive-priv/src/closure.rs): a path the host built itself is valid in its store
# without the swarm signature, the pull leaves it so, and `nix store copy-sigs`
# imports the signature from the cache.
set -uo pipefail
failures=0
@ -91,5 +96,44 @@ conf plain ""
if pull plain d2; then fail "realised without the swarm cache"; fi
expect "no top path" "$(valid d2 "$top")" no
# A path built on the host is input-addressed and so, unlike the toFile paths
# above, has no content address that lets `nix store verify` pass it unsigned.
# The stores here share one store directory (`store=`), as cache and host do.
case="setup: a path built in the host store, and the swarm cache holding it signed"
: "${HIVE_TEST_BASH:=$(command -v bash)}"
host="local?store=$T/hs&state=$T/hs-state&log=$T/hs-log"
built=$(nix build --store "$host" --no-link --print-out-paths --impure --expr "derivation { name = \"agent-closure\"; system = builtins.currentSystem; builder = \"$HIVE_TEST_BASH\"; args = [ \"-c\" \"echo agent > \$out\" ]; }")
nix copy --from "$host" --to "file://$T/signed?store=$T/hs&secret-key=$T/swarm.sec" "$built"
swarm_key=$(cat "$T/swarm.pub")
other_key=$(cat "$T/up.pub")
# verify <key>: hive-priv's check, against the host store.
verify() {
nix store verify --store "$host" --no-contents --sigs-needed 1 --option trusted-public-keys "$1" "$built" >/dev/null 2>&1
echo $?
}
# copy_sigs <cache url>: the exact arguments of copy_sigs_args, bar the store.
copy_sigs() {
nix store copy-sigs --store "$host" --substituter "$1" --option netrc-file "$T/netrc" "$built" >/dev/null 2>"$T/err"
}
case="control: the path is valid in the host store and the cache serves it signed"
expect "valid" "$(nix-store --store "$host" --check-validity "$built" && echo yes || echo no)" yes
expect "the cache has its narinfo" "$(if [ -e "$T/signed/$(basename "$built" | cut -c1-32).narinfo" ]; then echo yes; else echo no; fi)" yes
case="a path valid in the host store without the signature fails the verify"
expect "verify exit" "$(verify "$swarm_key")" 2
case="a cache without the path imports nothing and the verify still refuses"
copy_sigs "file://$T/empty-cache?store=$T/hs"
expect "copy-sigs exit" $? 0
expect "verify exit" "$(verify "$swarm_key")" 2
case="the cache serving the path imports the signature and the verify passes"
copy_sigs "file://$T/signed?store=$T/hs"
expect "copy-sigs exit" $? 0
expect "verify exit" "$(verify "$swarm_key")" 0
expect "another key still fails" "$(verify "$other_key")" 2
echo "$count checks, $failures failed"
[ "$failures" = 0 ]