aboutsummaryrefslogtreecommitdiff
path: root/perl
AgeCommit message (Collapse)Author
2014-01-08Support cryptographically signed binary cachesEelco Dolstra
NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-12-20perl: Call loadConfFile() in doInit to avoid screwing sqlite journal mode.Petr Rockai
If the database is opened through perl bindings (and even though nix.conf has use-sqlite-wal set to false), the database is automatically converted into WAL mode. This makes the next nix process to access the database convert it back to "truncate". If the database is still open at the time in wal mode by the perl program, this fails and crashes the nix doing the wal -> truncate conversion.
2013-12-02Install bsdiff and bspatch in $(libexecdir)/nixEelco Dolstra
2013-11-25Add a Makefile for the Perl stuffEelco Dolstra
2013-10-24Fix segfault on DarwinEelco Dolstra
Ever since SQLite in Nixpkgs was updated to 3.8.0.2, Nix has randomly segfaulted on Darwin: http://hydra.nixos.org/build/6175515 http://hydra.nixos.org/build/6611038 It turns out that this is because the binary cache substituter somehow ends up loading two versions of SQLite: the one in Nixpkgs and the other from /usr/lib/libsqlite3.dylib. It's not exactly clear why the latter is loaded, but it appears to be because WWW::Curl indirectly loads /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation, which in turn seems to load /usr/lib/libsqlite3.dylib. This leads to a segfault when Perl exits: #0 0x00000001010375f4 in sqlite3_finalize () #1 0x000000010125806e in sqlite_st_destroy () #2 0x000000010124bc30 in XS_DBD__SQLite__st_DESTROY () #3 0x00000001001c8155 in XS_DBI_dispatch () ... #14 0x0000000100023224 in perl_destruct () #15 0x0000000100000d6a in main () ... The workaround is to explicitly load DBD::SQLite before WWW::Curl.
2013-09-06Don't apply the CPU affinity hack to nix-shell (and other Perl programs)Eelco Dolstra
As discovered by Todd Veldhuizen, the shell started by nix-shell has its affinity set to a single CPU. This is because nix-shell connects to the Nix daemon, which causes the affinity hack to be applied. So we turn this off for Perl programs.
2013-06-20Don't keep "disabled" substituters runningEelco Dolstra
For instance, it's pointless to keep copy-from-other-stores running if there are no other stores, or download-using-manifests if there are no manifests. This also speeds things up because we don't send queries to those substituters.
2013-05-10build-remote.pl: Properly close the SSH connection between attemptsEelco Dolstra
2013-05-03Fixing the pv position regarding compressionLluís Batlle i Rossell
Problem noticed by niksnut.
2013-05-03Adding ETA support to the --show-progress in nix-copy-closureLluís Batlle i Rossell
Based on https://github.com/NixOS/nix/pull/6 from shlevy
2013-03-08Revert "Prevent config.h from being clobbered"Eelco Dolstra
This reverts commit 28bba8c44f484eae38e8a15dcec73cfa999156f6.
2013-03-08Fix annoying Perl 5.16 warningsEelco Dolstra
I.e. Subroutine Nix::Store::isValidPath redefined at /nix/store/clfzsf6gi7qh5i9c0vks1ifjam47rijn-perl-5.16.2/lib/perl5/5.16.2/XSLoader.pm line 92. and so on.
2013-03-07Prevent config.h from being clobberedEelco Dolstra
2013-02-05Nix::Store::derivationFromPath: Return derivation outputsEelco Dolstra
2012-12-20Give a better error message if writeFile fails due to permission issuesEelco Dolstra
2012-11-23nix-copy-closure: Add flag ‘--use-substitutes’Eelco Dolstra
2012-10-17nix-push: Only generate and copy a NAR if it doesn't already existEelco Dolstra
This prevents unnecessary and slow rebuilds of NARs that already exist in the binary cache.
2012-10-10Out-of-tree building of perl modules.Mats Erik Andersson
2012-09-19Support xz compression in the download-using-manifests substituterEelco Dolstra
2012-09-13Delete manifests in "nix-channel --remove" or when a binary cache is availableEelco Dolstra
2012-08-27Drop dependency on List::MoreUtilsEelco Dolstra
2012-08-27Add missing fileEelco Dolstra
2012-07-30Refactor settings processingEelco Dolstra
Put all Nix configuration flags in a Settings object.
2012-07-30Do some validation of URLsEelco Dolstra
2012-07-30Pass configuration settings to the substitutersEelco Dolstra
Previously substituters could read nix.conf themselves, but this didn't take --option flags into account.
2012-07-18Merge branch 'master' into no-manifestsEelco Dolstra
2012-07-17Add function queryPathFromHashPart()Eelco Dolstra
To implement binary caches efficiently, Hydra needs to be able to map the hash part of a store path (e.g. "gbg...zr7") to the full store path (e.g. "/nix/store/gbg...kzr7-subversion-1.7.5"). (The binary cache mechanism uses hash parts as a key for looking up store paths to ensure privacy.) However, doing a search in the Nix store for /nix/store/<hash>* is expensive since it requires reading the entire directory. queryPathFromHashPart() prevents this by doing a cheap database lookup.
2012-07-17queryPathInfo(): return hash in base-32 if desiredEelco Dolstra
Cherry-picked from the no-manifests branch.
2012-07-11Set the User-Agent header to "Nix/<version>"Eelco Dolstra
2012-07-09download-from-binary-cache: add nix.conf optionsEelco Dolstra
2012-07-02nix-push: Always generate base-32 hashesEelco Dolstra
2012-06-29First attempt at the manifest-less substituterEelco Dolstra
2012-06-29Use XZ compression in binary cachesEelco Dolstra
XZ compresses significantly better than bzip2. Here are the compression ratios and execution times (using 4 cores in parallel) on my /var/run/current-system (3.1 GiB): bzip2: total compressed size 849.56 MiB, 30.8% [2m08] xz -6: total compressed size 641.84 MiB, 23.4% [6m53] xz -7: total compressed size 621.82 MiB, 22.6% [7m19] xz -8: total compressed size 599.33 MiB, 21.8% [7m18] xz -9: total compressed size 588.18 MiB, 21.4% [7m40] Note that compression takes much longer. More importantly, however, decompression is much faster: bzip2: 1m47.274s xz -6: 0m55.446s xz -7: 0m54.119s xz -8: 0m52.388s xz -9: 0m51.842s The only downside to using -9 is that decompression takes a fair amount (~65 MB) of memory.
2012-05-10Support building with the Perl XS bindings disabledEelco Dolstra
Since the Perl bindings require shared libraries, this is required on platforms such as Cygwin where we do a static build.
2012-05-10Remove an obsolete hackEelco Dolstra
2012-05-04Fix some 32-bit buildsEelco Dolstra
Perl on some 32-bit systems needs -D_FILE_OFFSET_BITS=64. See also commit 02f1363e19b7df7cccc3523805bbf4fafe429529.
2012-05-04Drop the Perl-specific CFLAGSEelco Dolstra
This fixes the Darwin build (http://hydra.nixos.org/build/2517380). Hopefully it doesn't break other builds.
2012-04-13nix-copy-closure: Move the progressViewer directly adjacent to the ssh call ↵Shea Levy
so that network progress is what's measured
2012-04-13Add the '--show-progress' flag to nix-copy-closureShea Levy
2012-04-10Unconfuse RobEelco Dolstra
2012-03-19Add a command "nix-build --run-env" to reproduce the environment of a derivationEelco Dolstra
This command builds or fetches all dependencies of the given derivation, then starts a shell with the environment variables from the derivation. This shell also sources $stdenv/setup to initialise the environment further. The current directory is not changed. Thus this is a convenient way to reproduce a build environment in an existing working tree. Existing environment variables are left untouched (unless the derivation overrides them). As a special hack, the original value of $PATH is appended to the $PATH produced by $stdenv/setup. Example session: $ nix-build --run-env '<nixpkgs>' -A xterm (the dependencies of xterm are built/fetched...) $ tar xf $src $ ./configure $ make $ emacs (... hack source ...) $ make $ ./xterm
2012-03-05nix-copy-closure: don't print copied path on stdoutEelco Dolstra
We're already printing progress on stderr, so printing them on stdout afterwards is kind of useless.
2012-03-05Restore progress indication during nix-copy-closureEelco Dolstra
2012-01-18* Don't distribute Store.cc, it's generated automatically by xsubpp.Eelco Dolstra
2012-01-18* Pass the appropriate flags to GCC when building the Perl bindings.Eelco Dolstra
Without these, Nix fails on 32-bit Linux with Perl 5.14, with a rather unhelpful error message: Not a CODE reference at /nix/store/n6kpbacn6nn7i3i735v8j3di8aqyl07v-perl-5.14.2/lib/perl5/5.14.2/i686-linux-thread-multi/DynaLoader.pm This is likely because the lack of -D_FILE_OFFSET_BITS=64 causes various Perl structures to not match what the Perl interpreter expects.
2012-01-12* ‘-module’ causes the generated library to have an .so extension onEelco Dolstra
Mac OS X instead of .dylib, so don't do that.
2012-01-11perl: Build libNixStore.la with `-module'.Ludovic Courtès
2012-01-11* Figure out the extension of dynamic libraries; don't hard-code .so.Eelco Dolstra
2012-01-05* Add a -I flag to the Perl bindings to nix-build and some otherEelco Dolstra
scripts. * Include the version and architecture in the -I flag so that there is at least a chance that a Nix binary built for one Perl version will run on another version.
2012-01-03* Sync with the trunk.Eelco Dolstra
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 16:11:58 +0000