lix -

Age	Commit message (Collapse)	Author
2015-02-18	nix-store --generate-binary-cache-key: Write key to disk	Eelco Dolstra
	This ensures proper permissions for the secret key.
2015-02-10	Make libsodium an optional dependency	Eelco Dolstra

2015-02-04	Use libsodium instead of OpenSSL for binary cache signing	Eelco Dolstra
	Sodium's Ed25519 signatures are much shorter than OpenSSL's RSA signatures. Public keys are also much shorter, so they're now specified directly in the nix.conf option ‘binary-cache-public-keys’. The new command ‘nix-store --generate-binary-cache-key’ generates and prints a public and secret key.
2014-02-26	Test executables in NARs	Eelco Dolstra

2014-02-17	Add a test for repairing paths	Eelco Dolstra

2014-01-08	Fix signed-binary-caches test	Eelco Dolstra

2014-01-08	Test whether Nix correctly checks the hash of downloaded NARs	Eelco Dolstra

2014-01-08	Support cryptographically signed binary caches	Eelco Dolstra
	NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75.
2013-07-01	Add support for uncompressed NARs in binary caches	Eelco Dolstra
	Issue NixOS/hydra#102.
2013-04-23	Test whether --fallback works if NARS have disappeared from the binary cache	Eelco Dolstra

2013-04-23	Test NAR info caching	Eelco Dolstra

2013-01-02	If a substitute closure is incomplete, build dependencies, then retry the ↵	Eelco Dolstra
	substituter Issue #77.
2013-01-02	Add a test for incomplete closures in the binary cache	Eelco Dolstra
	Issue #77.
2012-12-03	Test the ‘--prebuilt-only’ flag	Eelco Dolstra

2012-09-12	Fix test failure on Darwin	Eelco Dolstra
	Apparently our DBD::SQLite links against /usr/lib/libsqlite3.dylib, which is an old version that doesn't respect foreign key constraints. So manifests/cache.sqlite doesn't get updated properly when a manifest disappears. We should fix our DBD::SQLite, but in the meantime this will fix the test. http://hydra.nixos.org/build/3017959
2012-07-30	Fix the test	Eelco Dolstra

2012-07-27	Allow a binary cache to declare that it doesn't support "nix-env -qas"	Eelco Dolstra
	Querying all substitutable paths via "nix-env -qas" is potentially hard on a server, since it involves sending thousands of HEAD requests. So a binary cache must now have a meta-info file named "nix-cache-info" that specifies whether the server wants this. It also specifies the store prefix so that we don't send useless queries to a binary cache for a different store prefix.
2012-07-27	Test "nix-env -qas" with the binary cache substituter	Eelco Dolstra

2012-07-26	Add a test for the binary cache substituter	Eelco Dolstra