danderson/channel-scripts
0
0
Fork 0
forked from the-distro/channel-scripts
Code Pull requests Activity

Sign cache.nixos.org

Browse source
This commit is contained in:
Eelco Dolstra 2015-02-19 14:26:33 +01:00
parent 3218e8b885
commit 8db0250c1f
1 changed files with 28 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
mirror-channel.pl
View file

@ -3,14 +3,15 @@
# already available in the target directory.
use strict;
use Nix::Manifest;
use Nix::Utils;
use Nix::Store;
use File::Basename;
use File::stat;
use Net::Amazon::S3;
use List::MoreUtils qw(part);
use Forks::Super 'bg_eval';
use List::MoreUtils qw(part);
use MIME::Base64;
use Net::Amazon::S3;
use Nix::Manifest;
use Nix::Store;
use Nix::Utils;
if (scalar @ARGV < 4 || scalar @ARGV > 6) {
@ -33,6 +34,17 @@ die "$dstChannelPath doesn't exist\n" unless -d $dstChannelPath;
my $manifestPath = "$dstChannelPath/MANIFEST";
# Read the secret key for signing .narinfo files.
my $secretKeyFile = "/home/hydra-mirror/.keys/cache.nixos.org-1/secret"; # FIXME: make configurable
my ($keyName, $secretKey);
if (defined $secretKeyFile) {
my $s = readFile $secretKeyFile;
chomp $s;
($keyName, $secretKey) = split ":", $s;
die "invalid secret key file ‘$secretKeyFile’\n" unless defined $keyName && defined $secretKey;
}
# S3 setup.
my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'} or die;
my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'} or die;
@ -89,13 +101,6 @@ sub permute {
}
sub queryPathHash16 {
my ($storePath) = @_;
my ($deriver, $narHash, $time, $narSize, $refs) = queryPathInfo($storePath, 0);
return $narHash;
}
# Download every file that we don't already have, and update every URL
# to point to the mirror. Also fill in the size and hash fields in
# the manifest in order to be compatible with Nix < 0.13.
@ -133,12 +138,12 @@ sub mirrorStorePath {
my $dstFileTmp = "/tmp/nar.$$";
my $ext;
if (isValidPath($storePath) && queryPathHash16($storePath) eq $nar->{narHash}) {
if (isValidPath($storePath) && queryPathHash($storePath) eq $nar->{narHash}) {
print STDERR "copying $storePath\n";
# Verify that $storePath hasn't been corrupted and compress it at the same time.
$ext = "xz";
my $narHash = `bash -c 'exec 4>&1; nix-store --dump $storePath | tee >(nix-hash --type sha256 --flat /dev/stdin >&4) | xz -7 > $dstFileTmp'`;
my $narHash = `bash -c 'exec 4>&1; nix-store --dump $storePath | tee >(nix-hash --type sha256 --base32 --flat /dev/stdin >&4) | xz -7 > $dstFileTmp'`;
chomp $narHash;
die "hash mismatch in `$storePath'" if "sha256:$narHash" ne $nar->{narHash};
} else {
@ -148,7 +153,7 @@ sub mirrorStorePath {
# Verify whether the downloaded file is a bzipped NAR file
# that matches the NAR hash given in the manifest.
$ext = "bz2";
my $narHash = `bunzip2 < $dstFileTmp | nix-hash --type sha256 --flat /dev/stdin` or die;
my $narHash = `bunzip2 < $dstFileTmp | nix-hash --type sha256 --base32 --flat /dev/stdin` or die;
chomp $narHash;
die "hash mismatch in downloaded file `$nar->{url}'" if "sha256:$narHash" ne $nar->{narHash};
}
@ -169,6 +174,7 @@ sub mirrorStorePath {
# Write the .narinfo.
my $info;
my @refs = split " ", $nar->{references};
$info .= "StorePath: $storePath\n";
$info .= "URL: nar/$fileHash.nar.$ext\n";
$info .= "Compression: " . ($ext eq "xz" ? "xz" : "bzip2") . "\n";
@ -176,10 +182,16 @@ sub mirrorStorePath {
$info .= "FileSize: $nar->{size}\n";
$info .= "NarHash: $nar->{narHash}\n";
$info .= "NarSize: $nar->{narSize}\n";
$info .= "References: " . join(" ", map { basename $_ } (split " ", $nar->{references})) . "\n";
$info .= "References: " . join(" ", map { basename $_ } @refs) . "\n";
$info .= "Deriver: " . basename $nar->{deriver} . "\n" if $nar->{deriver} ne "";
$info .= "System: $nar->{system}\n" if defined $nar->{system};
if (defined $keyName) {
my $fingerprint = fingerprintPath($storePath, $nar->{narHash}, $nar->{narSize}, \@refs);
my $sig = encode_base64(signString(decode_base64($secretKey), $fingerprint), "");
$info .= "Sig: $keyName:$sig\n";
}
$bucket->add_key($narInfoFile, $info) or die "failed to upload $narInfoFile to S3\n";
}