lix-project/lix-releng-staging
0
0
Fork 0
Code Packages Activity
lix-releng-staging/tests/binary-cache.sh

88 lines
2.4 KiB
Bash
Raw Normal View History

Add a test for the binary cache substituter
2012-07-26 21:13:14 +00:00
source common.sh
clearStore
Fix test failure on Darwin Apparently our DBD::SQLite links against /usr/lib/libsqlite3.dylib, which is an old version that doesn't respect foreign key constraints. So manifests/cache.sqlite doesn't get updated properly when a manifest disappears. We should fix our DBD::SQLite, but in the meantime this will fix the test. http://hydra.nixos.org/build/3017959
2012-09-12 15:29:10 +00:00
clearManifests
Add a test for repairing paths
2014-02-17 11:22:50 +00:00
clearCache
Add a test for the binary cache substituter
2012-07-26 21:13:14 +00:00
Test "nix-env -qas" with the binary cache substituter
2012-07-27 18:15:03 +00:00
# Create the binary cache.
Add a test for the binary cache substituter
2012-07-26 21:13:14 +00:00
outPath=$(nix-build dependencies.nix --no-out-link)
nix-push --dest $cacheDir $outPath
Allow a binary cache to declare that it doesn't support "nix-env -qas" Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27 22:16:05 +00:00
# By default, a binary cache doesn't support "nix-env -qas", but does
# support installation.
Add a test for the binary cache substituter
2012-07-26 21:13:14 +00:00
clearStore
rm -f $NIX_STATE_DIR/binary-cache*
Test NAR info caching
2013-04-23 10:43:28 +00:00
export _NIX_CACHE_FILE_URLS=1
Fix the test
2012-07-30 21:09:13 +00:00
nix-env --option binary-caches "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---"
Allow a binary cache to declare that it doesn't support "nix-env -qas" Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27 22:16:05 +00:00
Fix the test
2012-07-30 21:09:13 +00:00
nix-store --option binary-caches "file://$cacheDir" -r $outPath
Allow a binary cache to declare that it doesn't support "nix-env -qas" Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27 22:16:05 +00:00
# But with the right configuration, "nix-env -qas" should also work.
clearStore
rm -f $NIX_STATE_DIR/binary-cache*
echo "WantMassQuery: 1" >> $cacheDir/nix-cache-info
Fix the test
2012-07-30 21:09:13 +00:00
nix-env --option binary-caches "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
Test "nix-env -qas" with the binary cache substituter
2012-07-27 18:15:03 +00:00
Test the ‘--prebuilt-only’ flag
2012-12-03 20:02:06 +00:00
x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only)
[ -z "$x" ]
Fix the test
2012-07-30 21:09:13 +00:00
nix-store --option binary-caches "file://$cacheDir" -r $outPath
Add a test for the binary cache substituter
2012-07-26 21:13:14 +00:00
nix-store --check-validity $outPath
nix-store -qR $outPath | grep input-2
Allow a binary cache to declare that it doesn't support "nix-env -qas" Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27 22:16:05 +00:00
Add a test for incomplete closures in the binary cache Issue #77.
2013-01-02 10:45:23 +00:00
Test whether Nix correctly checks the hash of downloaded NARs
2014-01-08 16:56:30 +00:00
# Test whether Nix notices if the NAR doesn't match the hash in the NAR info.
clearStore
nar=$(ls $cacheDir/*.nar.xz | head -n1)
mv $nar $nar.good
mkdir -p $TEST_ROOT/empty
nix-store --dump $TEST_ROOT/empty | xz > $nar
nix-build --option binary-caches "file://$cacheDir" dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
grep -q "hash mismatch in downloaded path" $TEST_ROOT/log
mv $nar.good $nar
Support cryptographically signed binary caches NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2014-01-08 14:23:41 +00:00
# Test whether this unsigned cache is rejected if the user requires signed caches.
clearStore
rm -f $NIX_STATE_DIR/binary-cache*
Fix signed-binary-caches test
2014-01-08 16:56:58 +00:00
if nix-store --option binary-caches "file://$cacheDir" --option signed-binary-caches '*' -r $outPath; then
echo "unsigned binary cache incorrectly accepted"
exit 1
fi
Support cryptographically signed binary caches NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2014-01-08 14:23:41 +00:00
Test whether --fallback works if NARS have disappeared from the binary cache
2013-04-23 10:44:01 +00:00
# Test whether fallback works if we have cached info but the
# corresponding NAR has disappeared.
clearStore
nix-build --option binary-caches "file://$cacheDir" dependencies.nix --dry-run # get info
mkdir $cacheDir/tmp
Add support for uncompressed NARs in binary caches Issue NixOS/hydra#102.
2013-07-01 19:02:36 +00:00
mv $cacheDir/*.nar* $cacheDir/tmp/
Test whether --fallback works if NARS have disappeared from the binary cache
2013-04-23 10:44:01 +00:00
NIX_DEBUG_SUBST=1 nix-build --option binary-caches "file://$cacheDir" dependencies.nix -o $TEST_ROOT/result --fallback
mv $cacheDir/tmp/* $cacheDir/
Add a test for incomplete closures in the binary cache Issue #77.
2013-01-02 10:45:23 +00:00
# Test whether building works if the binary cache contains an
# incomplete closure.
clearStore
rm $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo)
If a substitute closure is incomplete, build dependencies, then retry the substituter Issue #77.
2013-01-02 11:38:28 +00:00
nix-build --option binary-caches "file://$cacheDir" dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
grep -q "Downloading" $TEST_ROOT/log
Copy permalink