prefix Metadata fields

This commit is contained in:
sorki 2023-12-04 19:04:32 +01:00
parent fb1bcfdb61
commit a8077c5031
7 changed files with 55 additions and 46 deletions

View File

@ -26,8 +26,13 @@ import qualified Data.Text as Text
-- | Produce the message signed by a NAR signature
metadataFingerprint :: StoreDir -> StorePath -> Metadata StorePath -> Text
metadataFingerprint storeDir storePath Metadata{..} = let
narSize = fromMaybe 0 narBytes
in fingerprint storeDir storePath narHash narSize (HashSet.toList references)
narSize = fromMaybe 0 metadataNarBytes
in fingerprint
storeDir
storePath
metadataNarHash
narSize
(HashSet.toList metadataReferences)
-- | Produce the message signed by a NAR signature
fingerprint :: StoreDir

View File

@ -35,25 +35,25 @@ data StorePathTrust
data Metadata a = Metadata
{ -- | The path to the derivation file that built this path, if any
-- and known.
deriverPath :: !(Maybe a)
metadataDeriverPath :: !(Maybe a)
, -- | The hash of the nar serialization of the path.
narHash :: !(DSum HashAlgo Digest)
metadataNarHash :: !(DSum HashAlgo Digest)
, -- | The paths that this path directly references
references :: !(HashSet a)
metadataReferences :: !(HashSet a)
, -- | When was this path registered valid in the store?
registrationTime :: !UTCTime
metadataRegistrationTime :: !UTCTime
, -- | The size of the nar serialization of the path, in bytes.
narBytes :: !(Maybe Word64)
metadataNarBytes :: !(Maybe Word64)
, -- | How much we trust this path. Nix-es ultimate
trust :: !StorePathTrust
metadataTrust :: !StorePathTrust
, -- | A set of cryptographic attestations of this path's validity.
--
-- There is no guarantee from this type alone that these
-- signatures are valid.
sigs :: !(Set NarSignature)
metadataSigs :: !(Set NarSignature)
, -- | Whether and how this store path is content-addressable.
--
-- There is no guarantee from this type alone that this address
-- is actually correct for this store path.
contentAddress :: !(Maybe ContentAddress)
metadataContentAddress :: !(Maybe ContentAddress)
} deriving (Eq, Generic, Ord, Show)

View File

@ -31,7 +31,11 @@ spec_fingerprint = do
it "allows a successful signature verification" $ do
let msg = Text.encodeUtf8 $ metadataFingerprint def exampleStorePath exampleMetadata
Signature sig' = head $ sig <$> filter (\(NarSignature publicKey _) -> publicKey == "cache.nixos.org-1") (Set.toList (sigs exampleMetadata))
Signature sig' =
head
$ sig
<$> filter (\(NarSignature publicKey _) -> publicKey == "cache.nixos.org-1")
(Set.toList (metadataSigs exampleMetadata))
sig' `shouldSatisfy` Ed25519.verify pubkey msg
exampleFingerprint :: Text
@ -42,14 +46,14 @@ exampleStorePath = forceRight $ parsePath def "/nix/store/syd87l2rxw8cbsxmxl853h
exampleMetadata :: Metadata StorePath
exampleMetadata = Metadata
{ deriverPath = Just $ forceRight $ parsePath def "/nix/store/5rwxzi7pal3qhpsyfc16gzkh939q1np6-curl-7.82.0.drv"
, narHash = forceRight $ mkNamedDigest "sha256" "1b4sb93wp679q4zx9k1ignby1yna3z7c4c2ri3wphylbc2dwsys0"
, references = HashSet.fromList $ forceRight . parsePath def <$> ["/nix/store/0jqd0rlxzra1rs38rdxl43yh6rxchgc6-curl-7.82.0","/nix/store/6w8g7njm4mck5dmjxws0z1xnrxvl81xa-glibc-2.34-115","/nix/store/j5jxw3iy7bbz4a57fh9g2xm2gxmyal8h-zlib-1.2.12","/nix/store/yxvjs9drzsphm9pcf42a4byzj1kb9m7k-openssl-1.1.1n"]
, registrationTime = UTCTime (fromOrdinalDate 0 0) 0
, narBytes = Just 196040
, trust = BuiltElsewhere
, sigs = Set.fromList $ forceRight . parseNarSignature <$> ["cache.nixos.org-1:TsTTb3WGTZKphvYdBHXwo6weVILmTytUjLB+vcX89fOjjRicCHmKA4RCPMVLkj6TMJ4GMX3HPVWRdD1hkeKZBQ==", "test1:519iiVLx/c4Rdt5DNt6Y2Jm6hcWE9+XY69ygiWSZCNGVcmOcyL64uVAJ3cV8vaTusIZdbTnYo9Y7vDNeTmmMBQ=="]
, contentAddress = Nothing
{ metadataDeriverPath = Just $ forceRight $ parsePath def "/nix/store/5rwxzi7pal3qhpsyfc16gzkh939q1np6-curl-7.82.0.drv"
, metadataNarHash = forceRight $ mkNamedDigest "sha256" "1b4sb93wp679q4zx9k1ignby1yna3z7c4c2ri3wphylbc2dwsys0"
, metadataReferences = HashSet.fromList $ forceRight . parsePath def <$> ["/nix/store/0jqd0rlxzra1rs38rdxl43yh6rxchgc6-curl-7.82.0","/nix/store/6w8g7njm4mck5dmjxws0z1xnrxvl81xa-glibc-2.34-115","/nix/store/j5jxw3iy7bbz4a57fh9g2xm2gxmyal8h-zlib-1.2.12","/nix/store/yxvjs9drzsphm9pcf42a4byzj1kb9m7k-openssl-1.1.1n"]
, metadataRegistrationTime = UTCTime (fromOrdinalDate 0 0) 0
, metadataNarBytes = Just 196040
, metadataTrust = BuiltElsewhere
, metadataSigs = Set.fromList $ forceRight . parseNarSignature <$> ["cache.nixos.org-1:TsTTb3WGTZKphvYdBHXwo6weVILmTytUjLB+vcX89fOjjRicCHmKA4RCPMVLkj6TMJ4GMX3HPVWRdD1hkeKZBQ==", "test1:519iiVLx/c4Rdt5DNt6Y2Jm6hcWE9+XY69ygiWSZCNGVcmOcyL64uVAJ3cV8vaTusIZdbTnYo9Y7vDNeTmmMBQ=="]
, metadataContentAddress = Nothing
}
pubkey :: Ed25519.PublicKey

View File

@ -328,34 +328,34 @@ queryPathInfoUncached path = do
valid <- sockGetBool
Control.Monad.unless valid $ error "Path is not valid"
deriverPath <- sockGetPathMay
metadataDeriverPath <- sockGetPathMay
narHashText <- Data.Text.Encoding.decodeUtf8 <$> sockGetStr
let
narHash =
metadataNarHash =
case
decodeDigestWith @SHA256 Base16 narHashText
of
Left e -> error e
Right d -> System.Nix.Hash.HashAlgo_SHA256 :=> d
references <- sockGetPaths
registrationTime <- sockGet getTime
narBytes <- Just <$> sockGetInt
metadataReferences <- sockGetPaths
metadataRegistrationTime <- sockGet getTime
metadataNarBytes <- Just <$> sockGetInt
ultimate <- sockGetBool
sigStrings <- fmap Data.Text.Encoding.decodeUtf8 <$> sockGetStrings
caString <- Data.Text.Encoding.decodeUtf8 <$> sockGetStr
let
sigs = case
metadataSigs = case
Data.Set.fromList
<$> mapM System.Nix.Signature.parseNarSignature sigStrings
of
Left e -> error e
Right x -> x
contentAddress =
metadataContentAddress =
if Data.Text.null caString then Nothing else
case
Data.Attoparsec.Text.parseOnly
@ -365,7 +365,7 @@ queryPathInfoUncached path = do
Left e -> error e
Right x -> Just x
trust = if ultimate then BuiltLocally else BuiltElsewhere
metadataTrust = if ultimate then BuiltLocally else BuiltElsewhere
pure $ Metadata{..}

View File

@ -501,25 +501,25 @@ pathMetadata
=> NixSerializer r SError (Metadata StorePath)
pathMetadata = Serializer
{ getS = do
deriverPath <- getS maybePath
metadataDeriverPath <- getS maybePath
digest' <- getS $ digest NixBase32
let narHash = System.Nix.Hash.HashAlgo_SHA256 :=> digest'
let metadataNarHash = System.Nix.Hash.HashAlgo_SHA256 :=> digest'
references <- getS $ hashSet storePath
registrationTime <- getS time
narBytes <- (\case
metadataReferences <- getS $ hashSet storePath
metadataRegistrationTime <- getS time
metadataNarBytes <- (\case
0 -> Nothing
size -> Just size) <$> getS int
trust <- getS storePathTrust
metadataTrust <- getS storePathTrust
sigs <- getS $ set narSignature
contentAddress <- getS maybeContentAddress
metadataSigs <- getS $ set narSignature
metadataContentAddress <- getS maybeContentAddress
pure $ Metadata{..}
, putS = \Metadata{..} -> do
putS maybePath deriverPath
putS maybePath metadataDeriverPath
let putNarHash
:: DSum HashAlgo Digest
@ -529,14 +529,14 @@ pathMetadata = Serializer
-> putS (digest @SHA256 NixBase32) d
_ -> throwError SError_NarHashMustBeSHA256
putNarHash narHash
putNarHash metadataNarHash
putS (hashSet storePath) references
putS time registrationTime
putS int $ Prelude.maybe 0 id $ narBytes
putS storePathTrust trust
putS (set narSignature) sigs
putS maybeContentAddress contentAddress
putS (hashSet storePath) metadataReferences
putS time metadataRegistrationTime
putS int $ Prelude.maybe 0 id $ metadataNarBytes
putS storePathTrust metadataTrust
putS (set narSignature) metadataSigs
putS maybeContentAddress metadataContentAddress
}
where
maybeContentAddress

View File

@ -227,7 +227,7 @@ spec_protocol = Hspec.around withNixDaemon $
context "queryPathInfoUncached" $
itRights "queries path info" $ withPath $ \path -> do
meta <- queryPathInfoUncached path
references meta `shouldSatisfy` HS.null
metadataReferences meta `shouldSatisfy` HS.null
context "ensurePath" $
itRights "simple ensure" $ withPath ensurePath

View File

@ -82,12 +82,12 @@ spec = parallel $ do
roundtripS storePathName
let narHashIsSHA256 Metadata{..} =
case narHash of
case metadataNarHash of
(System.Nix.Hash.HashAlgo_SHA256 :=> _) -> True
_ -> False
prop "Metadata (StorePath)"
$ \sd -> forAll (arbitrary `suchThat` (\m -> narHashIsSHA256 m && narBytes m /= Just 0))
$ \sd -> forAll (arbitrary `suchThat` (\m -> narHashIsSHA256 m && metadataNarBytes m /= Just 0))
$ roundtripSReader @StoreDir pathMetadata sd
prop "Some HashAlgo" $