LocalStore: Keep track of ultimately trusted paths

These are content-addressed paths or outputs of locally performed
builds. They are trusted even if they don't have signatures, so "nix
verify-paths" won't complain about them.
This commit is contained in:
Eelco Dolstra 2016-03-30 17:35:48 +02:00
parent b86555aa2b
commit 9cee600c88
7 changed files with 51 additions and 12 deletions

View file

@ -2743,6 +2743,14 @@ void DerivationGoal::registerOutputs()
throw Error(format("derivation %1% may not be deterministic: output %2% differs") throw Error(format("derivation %1% may not be deterministic: output %2% differs")
% drvPath % path); % drvPath % path);
} }
/* Since we verified the build, it's now ultimately
trusted. */
if (!info.ultimate) {
info.ultimate = true;
worker.store.registerValidPaths({info});
}
continue; continue;
} }
@ -2799,6 +2807,7 @@ void DerivationGoal::registerOutputs()
info.narSize = hash.second; info.narSize = hash.second;
info.references = references; info.references = references;
info.deriver = drvPath; info.deriver = drvPath;
info.ultimate = true;
infos.push_back(info); infos.push_back(info);
} }

View file

@ -184,7 +184,18 @@ LocalStore::LocalStore()
have performed the upgrade already. */ have performed the upgrade already. */
curSchema = getSchema(); curSchema = getSchema();
if (curSchema < 7) { upgradeStore7(); openDB(true); } if (curSchema < 7) { upgradeStore7(); }
openDB(false);
if (curSchema < 8) {
SQLiteTxn txn(db);
if (sqlite3_exec(db, "alter table ValidPaths add column ultimate integer", 0, 0, 0) != SQLITE_OK)
throwSQLiteError(db, "upgrading database schema");
if (sqlite3_exec(db, "alter table ValidPaths add column sigs text", 0, 0, 0) != SQLITE_OK)
throwSQLiteError(db, "upgrading database schema");
txn.commit();
}
writeFile(schemaPath, (format("%1%") % nixSchemaVersion).str()); writeFile(schemaPath, (format("%1%") % nixSchemaVersion).str());
@ -299,13 +310,13 @@ void LocalStore::openDB(bool create)
/* Prepare SQL statements. */ /* Prepare SQL statements. */
stmtRegisterValidPath.create(db, stmtRegisterValidPath.create(db,
"insert into ValidPaths (path, hash, registrationTime, deriver, narSize) values (?, ?, ?, ?, ?);"); "insert into ValidPaths (path, hash, registrationTime, deriver, narSize, ultimate) values (?, ?, ?, ?, ?, ?);");
stmtUpdatePathInfo.create(db, stmtUpdatePathInfo.create(db,
"update ValidPaths set narSize = ?, hash = ? where path = ?;"); "update ValidPaths set narSize = ?, hash = ?, ultimate = ? where path = ?;");
stmtAddReference.create(db, stmtAddReference.create(db,
"insert or replace into Refs (referrer, reference) values (?, ?);"); "insert or replace into Refs (referrer, reference) values (?, ?);");
stmtQueryPathInfo.create(db, stmtQueryPathInfo.create(db,
"select id, hash, registrationTime, deriver, narSize from ValidPaths where path = ?;"); "select id, hash, registrationTime, deriver, narSize, ultimate, sigs from ValidPaths where path = ?;");
stmtQueryReferences.create(db, stmtQueryReferences.create(db,
"select path from Refs join ValidPaths on reference = id where referrer = ?;"); "select path from Refs join ValidPaths on reference = id where referrer = ?;");
stmtQueryReferrers.create(db, stmtQueryReferrers.create(db,
@ -535,6 +546,7 @@ uint64_t LocalStore::addValidPath(const ValidPathInfo & info, bool checkOutputs)
(info.registrationTime == 0 ? time(0) : info.registrationTime) (info.registrationTime == 0 ? time(0) : info.registrationTime)
(info.deriver, info.deriver != "") (info.deriver, info.deriver != "")
(info.narSize, info.narSize != 0) (info.narSize, info.narSize != 0)
(info.ultimate ? 1 : 0, info.ultimate)
.exec(); .exec();
uint64_t id = sqlite3_last_insert_rowid(db); uint64_t id = sqlite3_last_insert_rowid(db);
@ -655,6 +667,11 @@ ValidPathInfo LocalStore::queryPathInfo(const Path & path)
/* Note that narSize = NULL yields 0. */ /* Note that narSize = NULL yields 0. */
info.narSize = useQueryPathInfo.getInt(4); info.narSize = useQueryPathInfo.getInt(4);
info.ultimate = sqlite3_column_int(stmtQueryPathInfo, 5) == 1;
s = (const char *) sqlite3_column_text(stmtQueryPathInfo, 6);
if (s) info.sigs = tokenizeString<StringSet>(s, " ");
/* Get the references. */ /* Get the references. */
auto useQueryReferences(stmtQueryReferences.use()(info.id)); auto useQueryReferences(stmtQueryReferences.use()(info.id));
@ -673,6 +690,7 @@ void LocalStore::updatePathInfo(const ValidPathInfo & info)
stmtUpdatePathInfo.use() stmtUpdatePathInfo.use()
(info.narSize, info.narSize != 0) (info.narSize, info.narSize != 0)
("sha256:" + printHash(info.narHash)) ("sha256:" + printHash(info.narHash))
(info.ultimate ? 1 : 0, info.ultimate)
(info.path) (info.path)
.exec(); .exec();
} }
@ -1022,9 +1040,10 @@ void LocalStore::registerValidPath(const ValidPathInfo & info)
void LocalStore::registerValidPaths(const ValidPathInfos & infos) void LocalStore::registerValidPaths(const ValidPathInfos & infos)
{ {
/* SQLite will fsync by default, but the new valid paths may not be fsync-ed. /* SQLite will fsync by default, but the new valid paths may not
* So some may want to fsync them before registering the validity, at the be fsync-ed. So some may want to fsync them before registering
* expense of some speed of the path registering operation. */ the validity, at the expense of some speed of the path
registering operation. */
if (settings.syncBeforeRegistering) sync(); if (settings.syncBeforeRegistering) sync();
return retrySQLite<void>([&]() { return retrySQLite<void>([&]() {
@ -1128,6 +1147,7 @@ Path LocalStore::addToStoreFromDump(const string & dump, const string & name,
info.path = dstPath; info.path = dstPath;
info.narHash = hash.first; info.narHash = hash.first;
info.narSize = hash.second; info.narSize = hash.second;
info.ultimate = true;
registerValidPath(info); registerValidPath(info);
} }
@ -1142,7 +1162,6 @@ Path LocalStore::addToStore(const string & name, const Path & _srcPath,
bool recursive, HashType hashAlgo, PathFilter & filter, bool repair) bool recursive, HashType hashAlgo, PathFilter & filter, bool repair)
{ {
Path srcPath(absPath(_srcPath)); Path srcPath(absPath(_srcPath));
debug(format("adding %1% to the store") % srcPath);
/* Read the whole path into memory. This is not a very scalable /* Read the whole path into memory. This is not a very scalable
method for very large paths, but `copyPath' is mainly used for method for very large paths, but `copyPath' is mainly used for
@ -1187,6 +1206,7 @@ Path LocalStore::addTextToStore(const string & name, const string & s,
info.narHash = hash; info.narHash = hash;
info.narSize = sink.s->size(); info.narSize = sink.s->size();
info.references = references; info.references = references;
info.ultimate = true;
registerValidPath(info); registerValidPath(info);
} }

View file

@ -15,8 +15,8 @@ namespace nix {
/* Nix store and database schema version. Version 1 (or 0) was Nix <= /* Nix store and database schema version. Version 1 (or 0) was Nix <=
0.7. Version 2 was Nix 0.8 and 0.9. Version 3 is Nix 0.10. 0.7. Version 2 was Nix 0.8 and 0.9. Version 3 is Nix 0.10.
Version 4 is Nix 0.11. Version 5 is Nix 0.12-0.16. Version 6 is Version 4 is Nix 0.11. Version 5 is Nix 0.12-0.16. Version 6 is
Nix 1.0. Version 7 is Nix 1.3. */ Nix 1.0. Version 7 is Nix 1.3. Version 8 is 1.12. */
const int nixSchemaVersion = 7; const int nixSchemaVersion = 8;
extern string drvsLogDir; extern string drvsLogDir;

View file

@ -252,6 +252,10 @@ ValidPathInfo RemoteStore::queryPathInfo(const Path & path)
info.references = readStorePaths<PathSet>(conn->from); info.references = readStorePaths<PathSet>(conn->from);
info.registrationTime = readInt(conn->from); info.registrationTime = readInt(conn->from);
info.narSize = readLongLong(conn->from); info.narSize = readLongLong(conn->from);
if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 16) {
info.ultimate = readInt(conn->from) != 0;
info.sigs = readStrings<StringSet>(conn->from);
}
return info; return info;
} }

View file

@ -4,7 +4,9 @@ create table if not exists ValidPaths (
hash text not null, hash text not null,
registrationTime integer not null, registrationTime integer not null,
deriver text, deriver text,
narSize integer narSize integer,
ultimate integer, -- null implies "false"
sigs text -- space-separated
); );
create table if not exists Refs ( create table if not exists Refs (

View file

@ -6,7 +6,7 @@ namespace nix {
#define WORKER_MAGIC_1 0x6e697863 #define WORKER_MAGIC_1 0x6e697863
#define WORKER_MAGIC_2 0x6478696f #define WORKER_MAGIC_2 0x6478696f
#define PROTOCOL_VERSION 0x10f #define PROTOCOL_VERSION 0x110
#define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00) #define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00)
#define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff) #define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff)

View file

@ -517,6 +517,10 @@ static void performOp(ref<LocalStore> store, bool trusted, unsigned int clientVe
stopWork(); stopWork();
to << info.deriver << printHash(info.narHash) << info.references to << info.deriver << printHash(info.narHash) << info.references
<< info.registrationTime << info.narSize; << info.registrationTime << info.narSize;
if (GET_PROTOCOL_MINOR(clientVersion) >= 16) {
to << info.ultimate
<< info.sigs;
}
break; break;
} }