From 0ae8d4033d0b140b98e45c57e25b23d1970d356c Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Tue, 25 Sep 2018 21:19:24 -0400
Subject: [PATCH 1/2] Fix overflow when verifying signatures of content
 addressable paths

---
 src/nix/verify.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/verify.cc b/src/nix/verify.cc
index 6540208a8..7ef571561 100644
--- a/src/nix/verify.cc
+++ b/src/nix/verify.cc
@@ -120,7 +120,7 @@ struct CmdVerify : StorePathsCommand
                             for (auto sig : sigs) {
                                 if (sigsSeen.count(sig)) continue;
                                 sigsSeen.insert(sig);
-                                if (info->checkSignature(publicKeys, sig))
+                                if (validSigs < ValidPathInfo::maxSigs && info->checkSignature(publicKeys, sig))
                                     validSigs++;
                             }
                         };

From b7091ce41e0073b147678f05b9a620b9bb2903c1 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Tue, 25 Sep 2018 22:18:52 -0400
Subject: [PATCH 2/2] Add a test for signed content-addressed paths

---
 tests/signing.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/signing.sh b/tests/signing.sh
index 469296391..9e29e3fbf 100644
--- a/tests/signing.sh
+++ b/tests/signing.sh
@@ -62,6 +62,10 @@ outPathCA=$(IMPURE_VAR1=foo IMPURE_VAR2=bar nix-build ./fixed.nix -A good.0 --no
 nix verify $outPathCA
 nix verify $outPathCA --sigs-needed 1000
 
+# Check that signing a content-addressed path doesn't overflow validSigs
+nix sign-paths --key-file $TEST_ROOT/sk1 $outPathCA
+nix verify -r $outPathCA --sigs-needed 1000 --trusted-public-keys $pk1
+
 # Copy to a binary cache.
 nix copy --to file://$cacheDir $outPath2