mirror of
https://github.com/haskell-nix/hnix-store.git
synced 2024-11-23 20:56:20 +03:00
prefix Metadata fields
This commit is contained in:
parent
fb1bcfdb61
commit
a8077c5031
@ -26,8 +26,13 @@ import qualified Data.Text as Text
|
||||
-- | Produce the message signed by a NAR signature
|
||||
metadataFingerprint :: StoreDir -> StorePath -> Metadata StorePath -> Text
|
||||
metadataFingerprint storeDir storePath Metadata{..} = let
|
||||
narSize = fromMaybe 0 narBytes
|
||||
in fingerprint storeDir storePath narHash narSize (HashSet.toList references)
|
||||
narSize = fromMaybe 0 metadataNarBytes
|
||||
in fingerprint
|
||||
storeDir
|
||||
storePath
|
||||
metadataNarHash
|
||||
narSize
|
||||
(HashSet.toList metadataReferences)
|
||||
|
||||
-- | Produce the message signed by a NAR signature
|
||||
fingerprint :: StoreDir
|
||||
|
@ -35,25 +35,25 @@ data StorePathTrust
|
||||
data Metadata a = Metadata
|
||||
{ -- | The path to the derivation file that built this path, if any
|
||||
-- and known.
|
||||
deriverPath :: !(Maybe a)
|
||||
metadataDeriverPath :: !(Maybe a)
|
||||
, -- | The hash of the nar serialization of the path.
|
||||
narHash :: !(DSum HashAlgo Digest)
|
||||
metadataNarHash :: !(DSum HashAlgo Digest)
|
||||
, -- | The paths that this path directly references
|
||||
references :: !(HashSet a)
|
||||
metadataReferences :: !(HashSet a)
|
||||
, -- | When was this path registered valid in the store?
|
||||
registrationTime :: !UTCTime
|
||||
metadataRegistrationTime :: !UTCTime
|
||||
, -- | The size of the nar serialization of the path, in bytes.
|
||||
narBytes :: !(Maybe Word64)
|
||||
metadataNarBytes :: !(Maybe Word64)
|
||||
, -- | How much we trust this path. Nix-es ultimate
|
||||
trust :: !StorePathTrust
|
||||
metadataTrust :: !StorePathTrust
|
||||
, -- | A set of cryptographic attestations of this path's validity.
|
||||
--
|
||||
-- There is no guarantee from this type alone that these
|
||||
-- signatures are valid.
|
||||
sigs :: !(Set NarSignature)
|
||||
metadataSigs :: !(Set NarSignature)
|
||||
, -- | Whether and how this store path is content-addressable.
|
||||
--
|
||||
-- There is no guarantee from this type alone that this address
|
||||
-- is actually correct for this store path.
|
||||
contentAddress :: !(Maybe ContentAddress)
|
||||
metadataContentAddress :: !(Maybe ContentAddress)
|
||||
} deriving (Eq, Generic, Ord, Show)
|
||||
|
@ -31,7 +31,11 @@ spec_fingerprint = do
|
||||
|
||||
it "allows a successful signature verification" $ do
|
||||
let msg = Text.encodeUtf8 $ metadataFingerprint def exampleStorePath exampleMetadata
|
||||
Signature sig' = head $ sig <$> filter (\(NarSignature publicKey _) -> publicKey == "cache.nixos.org-1") (Set.toList (sigs exampleMetadata))
|
||||
Signature sig' =
|
||||
head
|
||||
$ sig
|
||||
<$> filter (\(NarSignature publicKey _) -> publicKey == "cache.nixos.org-1")
|
||||
(Set.toList (metadataSigs exampleMetadata))
|
||||
sig' `shouldSatisfy` Ed25519.verify pubkey msg
|
||||
|
||||
exampleFingerprint :: Text
|
||||
@ -42,14 +46,14 @@ exampleStorePath = forceRight $ parsePath def "/nix/store/syd87l2rxw8cbsxmxl853h
|
||||
|
||||
exampleMetadata :: Metadata StorePath
|
||||
exampleMetadata = Metadata
|
||||
{ deriverPath = Just $ forceRight $ parsePath def "/nix/store/5rwxzi7pal3qhpsyfc16gzkh939q1np6-curl-7.82.0.drv"
|
||||
, narHash = forceRight $ mkNamedDigest "sha256" "1b4sb93wp679q4zx9k1ignby1yna3z7c4c2ri3wphylbc2dwsys0"
|
||||
, references = HashSet.fromList $ forceRight . parsePath def <$> ["/nix/store/0jqd0rlxzra1rs38rdxl43yh6rxchgc6-curl-7.82.0","/nix/store/6w8g7njm4mck5dmjxws0z1xnrxvl81xa-glibc-2.34-115","/nix/store/j5jxw3iy7bbz4a57fh9g2xm2gxmyal8h-zlib-1.2.12","/nix/store/yxvjs9drzsphm9pcf42a4byzj1kb9m7k-openssl-1.1.1n"]
|
||||
, registrationTime = UTCTime (fromOrdinalDate 0 0) 0
|
||||
, narBytes = Just 196040
|
||||
, trust = BuiltElsewhere
|
||||
, sigs = Set.fromList $ forceRight . parseNarSignature <$> ["cache.nixos.org-1:TsTTb3WGTZKphvYdBHXwo6weVILmTytUjLB+vcX89fOjjRicCHmKA4RCPMVLkj6TMJ4GMX3HPVWRdD1hkeKZBQ==", "test1:519iiVLx/c4Rdt5DNt6Y2Jm6hcWE9+XY69ygiWSZCNGVcmOcyL64uVAJ3cV8vaTusIZdbTnYo9Y7vDNeTmmMBQ=="]
|
||||
, contentAddress = Nothing
|
||||
{ metadataDeriverPath = Just $ forceRight $ parsePath def "/nix/store/5rwxzi7pal3qhpsyfc16gzkh939q1np6-curl-7.82.0.drv"
|
||||
, metadataNarHash = forceRight $ mkNamedDigest "sha256" "1b4sb93wp679q4zx9k1ignby1yna3z7c4c2ri3wphylbc2dwsys0"
|
||||
, metadataReferences = HashSet.fromList $ forceRight . parsePath def <$> ["/nix/store/0jqd0rlxzra1rs38rdxl43yh6rxchgc6-curl-7.82.0","/nix/store/6w8g7njm4mck5dmjxws0z1xnrxvl81xa-glibc-2.34-115","/nix/store/j5jxw3iy7bbz4a57fh9g2xm2gxmyal8h-zlib-1.2.12","/nix/store/yxvjs9drzsphm9pcf42a4byzj1kb9m7k-openssl-1.1.1n"]
|
||||
, metadataRegistrationTime = UTCTime (fromOrdinalDate 0 0) 0
|
||||
, metadataNarBytes = Just 196040
|
||||
, metadataTrust = BuiltElsewhere
|
||||
, metadataSigs = Set.fromList $ forceRight . parseNarSignature <$> ["cache.nixos.org-1:TsTTb3WGTZKphvYdBHXwo6weVILmTytUjLB+vcX89fOjjRicCHmKA4RCPMVLkj6TMJ4GMX3HPVWRdD1hkeKZBQ==", "test1:519iiVLx/c4Rdt5DNt6Y2Jm6hcWE9+XY69ygiWSZCNGVcmOcyL64uVAJ3cV8vaTusIZdbTnYo9Y7vDNeTmmMBQ=="]
|
||||
, metadataContentAddress = Nothing
|
||||
}
|
||||
|
||||
pubkey :: Ed25519.PublicKey
|
||||
|
@ -328,34 +328,34 @@ queryPathInfoUncached path = do
|
||||
valid <- sockGetBool
|
||||
Control.Monad.unless valid $ error "Path is not valid"
|
||||
|
||||
deriverPath <- sockGetPathMay
|
||||
metadataDeriverPath <- sockGetPathMay
|
||||
|
||||
narHashText <- Data.Text.Encoding.decodeUtf8 <$> sockGetStr
|
||||
let
|
||||
narHash =
|
||||
metadataNarHash =
|
||||
case
|
||||
decodeDigestWith @SHA256 Base16 narHashText
|
||||
of
|
||||
Left e -> error e
|
||||
Right d -> System.Nix.Hash.HashAlgo_SHA256 :=> d
|
||||
|
||||
references <- sockGetPaths
|
||||
registrationTime <- sockGet getTime
|
||||
narBytes <- Just <$> sockGetInt
|
||||
metadataReferences <- sockGetPaths
|
||||
metadataRegistrationTime <- sockGet getTime
|
||||
metadataNarBytes <- Just <$> sockGetInt
|
||||
ultimate <- sockGetBool
|
||||
|
||||
sigStrings <- fmap Data.Text.Encoding.decodeUtf8 <$> sockGetStrings
|
||||
caString <- Data.Text.Encoding.decodeUtf8 <$> sockGetStr
|
||||
|
||||
let
|
||||
sigs = case
|
||||
metadataSigs = case
|
||||
Data.Set.fromList
|
||||
<$> mapM System.Nix.Signature.parseNarSignature sigStrings
|
||||
of
|
||||
Left e -> error e
|
||||
Right x -> x
|
||||
|
||||
contentAddress =
|
||||
metadataContentAddress =
|
||||
if Data.Text.null caString then Nothing else
|
||||
case
|
||||
Data.Attoparsec.Text.parseOnly
|
||||
@ -365,7 +365,7 @@ queryPathInfoUncached path = do
|
||||
Left e -> error e
|
||||
Right x -> Just x
|
||||
|
||||
trust = if ultimate then BuiltLocally else BuiltElsewhere
|
||||
metadataTrust = if ultimate then BuiltLocally else BuiltElsewhere
|
||||
|
||||
pure $ Metadata{..}
|
||||
|
||||
|
@ -501,25 +501,25 @@ pathMetadata
|
||||
=> NixSerializer r SError (Metadata StorePath)
|
||||
pathMetadata = Serializer
|
||||
{ getS = do
|
||||
deriverPath <- getS maybePath
|
||||
metadataDeriverPath <- getS maybePath
|
||||
|
||||
digest' <- getS $ digest NixBase32
|
||||
let narHash = System.Nix.Hash.HashAlgo_SHA256 :=> digest'
|
||||
let metadataNarHash = System.Nix.Hash.HashAlgo_SHA256 :=> digest'
|
||||
|
||||
references <- getS $ hashSet storePath
|
||||
registrationTime <- getS time
|
||||
narBytes <- (\case
|
||||
metadataReferences <- getS $ hashSet storePath
|
||||
metadataRegistrationTime <- getS time
|
||||
metadataNarBytes <- (\case
|
||||
0 -> Nothing
|
||||
size -> Just size) <$> getS int
|
||||
trust <- getS storePathTrust
|
||||
metadataTrust <- getS storePathTrust
|
||||
|
||||
sigs <- getS $ set narSignature
|
||||
contentAddress <- getS maybeContentAddress
|
||||
metadataSigs <- getS $ set narSignature
|
||||
metadataContentAddress <- getS maybeContentAddress
|
||||
|
||||
pure $ Metadata{..}
|
||||
|
||||
, putS = \Metadata{..} -> do
|
||||
putS maybePath deriverPath
|
||||
putS maybePath metadataDeriverPath
|
||||
|
||||
let putNarHash
|
||||
:: DSum HashAlgo Digest
|
||||
@ -529,14 +529,14 @@ pathMetadata = Serializer
|
||||
-> putS (digest @SHA256 NixBase32) d
|
||||
_ -> throwError SError_NarHashMustBeSHA256
|
||||
|
||||
putNarHash narHash
|
||||
putNarHash metadataNarHash
|
||||
|
||||
putS (hashSet storePath) references
|
||||
putS time registrationTime
|
||||
putS int $ Prelude.maybe 0 id $ narBytes
|
||||
putS storePathTrust trust
|
||||
putS (set narSignature) sigs
|
||||
putS maybeContentAddress contentAddress
|
||||
putS (hashSet storePath) metadataReferences
|
||||
putS time metadataRegistrationTime
|
||||
putS int $ Prelude.maybe 0 id $ metadataNarBytes
|
||||
putS storePathTrust metadataTrust
|
||||
putS (set narSignature) metadataSigs
|
||||
putS maybeContentAddress metadataContentAddress
|
||||
}
|
||||
where
|
||||
maybeContentAddress
|
||||
|
@ -227,7 +227,7 @@ spec_protocol = Hspec.around withNixDaemon $
|
||||
context "queryPathInfoUncached" $
|
||||
itRights "queries path info" $ withPath $ \path -> do
|
||||
meta <- queryPathInfoUncached path
|
||||
references meta `shouldSatisfy` HS.null
|
||||
metadataReferences meta `shouldSatisfy` HS.null
|
||||
|
||||
context "ensurePath" $
|
||||
itRights "simple ensure" $ withPath ensurePath
|
||||
|
@ -82,12 +82,12 @@ spec = parallel $ do
|
||||
roundtripS storePathName
|
||||
|
||||
let narHashIsSHA256 Metadata{..} =
|
||||
case narHash of
|
||||
case metadataNarHash of
|
||||
(System.Nix.Hash.HashAlgo_SHA256 :=> _) -> True
|
||||
_ -> False
|
||||
|
||||
prop "Metadata (StorePath)"
|
||||
$ \sd -> forAll (arbitrary `suchThat` (\m -> narHashIsSHA256 m && narBytes m /= Just 0))
|
||||
$ \sd -> forAll (arbitrary `suchThat` (\m -> narHashIsSHA256 m && metadataNarBytes m /= Just 0))
|
||||
$ roundtripSReader @StoreDir pathMetadata sd
|
||||
|
||||
prop "Some HashAlgo" $
|
||||
|
Loading…
Reference in New Issue
Block a user