nix_compat/narinfo/
mod.rs

1//! NAR info files describe a store path in a traditional Nix binary cache.
2//! Over the wire, they are formatted as "Key: value" pairs separated by newlines.
3//!
4//! It contains four kinds of information:
5//! 1. the description of the store path itself
6//!    * store path prefix, digest, and name
7//!    * NAR hash and size
8//!    * references
9//! 2. authenticity information
10//!    * zero or more signatures over that description
11//!    * an optional [CAHash] for content-addressed paths (fixed outputs, sources, and derivations)
12//! 3. derivation metadata
13//!    * deriver (the derivation that produced this path)
14//!    * system (the system value of that derivation)
15//! 4. cache-specific information
16//!    * URL of the compressed NAR, relative to the NAR info file
17//!    * compression algorithm used for the NAR
18//!    * hash and size of the compressed NAR
19
20use bitflags::bitflags;
21use data_encoding::HEXLOWER;
22use std::{
23    fmt::{self, Display},
24    mem,
25};
26
27use crate::{
28    nixbase32,
29    nixhash::CAHash,
30    store_path::{ParseStorePathError, StorePathRef},
31};
32
33mod fingerprint;
34mod signature;
35mod signing_keys;
36mod verifying_keys;
37
38pub use fingerprint::fingerprint;
39pub use signature::{Error as SignatureError, Signature, SignatureRef};
40pub use signing_keys::parse_keypair;
41pub use signing_keys::{Error as SigningKeyError, SigningKey};
42pub use verifying_keys::{Error as VerifyingKeyError, VerifyingKey};
43
44#[derive(Debug)]
45pub struct NarInfo<'a> {
46    pub flags: Flags,
47    // core (authenticated, but unverified here)
48    /// Store path described by this [NarInfo]
49    pub store_path: StorePathRef<'a>,
50    /// SHA-256 digest of the NAR file
51    pub nar_hash: [u8; 32],
52    /// Size of the NAR file in bytes
53    pub nar_size: u64,
54    /// Store paths known to be referenced by the contents
55    pub references: Vec<StorePathRef<'a>>,
56    // authenticity
57    /// Ed25519 signature over the path fingerprint
58    pub signatures: Vec<SignatureRef<'a>>,
59    /// Content address (for content-defined paths)
60    pub ca: Option<CAHash>,
61    // derivation metadata
62    /// Nix system triple of [NarInfo::deriver]
63    pub system: Option<&'a str>,
64    /// Store path of the derivation that produced this. The last .drv suffix is stripped.
65    pub deriver: Option<StorePathRef<'a>>,
66    // cache-specific untrusted metadata
67    /// Relative URL of the compressed NAR file
68    pub url: &'a str,
69    /// Compression method of the NAR file
70    /// `None` means `Compression: none`.
71    ///
72    /// Nix interprets a missing `Compression` field as `Some("bzip2")`,
73    /// so we do as well. We haven't found any examples of this in the
74    /// wild, not even in the cache.nixos.org dataset.
75    pub compression: Option<&'a str>,
76    /// SHA-256 digest of the file at `url`
77    pub file_hash: Option<[u8; 32]>,
78    /// Size of the file at `url` in bytes
79    pub file_size: Option<u64>,
80}
81
82bitflags! {
83    /// TODO(edef): be conscious of these when roundtripping
84    #[derive(Debug, Copy, Clone)]
85    pub struct Flags: u8 {
86        const UNKNOWN_FIELD = 1 << 0;
87        const COMPRESSION_DEFAULT = 1 << 1;
88        // Format quirks encountered in the cache.nixos.org dataset
89        const REFERENCES_OUT_OF_ORDER = 1 << 2;
90        const NAR_HASH_HEX = 1 << 3;
91
92        /// Deriver: unknown-deriver, produced by a legacy tool
93        ///
94        /// Only relevant if [NarInfo::deriver] is [None],
95        /// but valid to have set either way.
96        const EXPLICIT_UNKNOWN_DERIVER = 1 << 4;
97
98        /// entirely missing References field, produced by harmonia
99        const REFERENCES_MISSING = 1 << 5;
100    }
101}
102
103const TAG_STOREPATH: &str = "StorePath";
104const TAG_URL: &str = "URL";
105const TAG_COMPRESSION: &str = "Compression";
106const TAG_FILEHASH: &str = "FileHash";
107const TAG_FILESIZE: &str = "FileSize";
108const TAG_NARHASH: &str = "NarHash";
109const TAG_NARSIZE: &str = "NarSize";
110const TAG_REFERENCES: &str = "References";
111const TAG_SYSTEM: &str = "System";
112const TAG_DERIVER: &str = "Deriver";
113const TAG_SIG: &str = "Sig";
114const TAG_CA: &str = "CA";
115
116impl<'a> NarInfo<'a> {
117    pub fn parse(input: &'a str) -> Result<Self, Error> {
118        let mut flags = Flags::empty();
119        let mut store_path = None;
120        let mut url = None;
121        let mut compression = None;
122        let mut file_hash = None;
123        let mut file_size = None;
124        let mut nar_hash = None;
125        let mut nar_size = None;
126        let mut references = None;
127        let mut system = None;
128        let mut deriver = None;
129        let mut signatures = vec![];
130        let mut ca = None;
131
132        for line in input.lines() {
133            let (tag, val) = line
134                .split_once(':')
135                .ok_or_else(|| Error::InvalidLine(line.to_string()))?;
136
137            let val = val
138                .strip_prefix(' ')
139                .ok_or_else(|| Error::InvalidLine(line.to_string()))?;
140
141            match tag {
142                TAG_STOREPATH => {
143                    let val = val
144                        .strip_prefix("/nix/store/")
145                        .ok_or(Error::InvalidStorePath(
146                            ParseStorePathError::MissingStoreDir,
147                        ))?;
148                    let val = StorePathRef::from_bytes(val.as_bytes())
149                        .map_err(Error::InvalidStorePath)?;
150
151                    if store_path.replace(val).is_some() {
152                        return Err(Error::DuplicateField(TAG_STOREPATH));
153                    }
154                }
155                TAG_URL => {
156                    if val.is_empty() {
157                        return Err(Error::EmptyField(TAG_URL));
158                    }
159
160                    if url.replace(val).is_some() {
161                        return Err(Error::DuplicateField(TAG_URL));
162                    }
163                }
164                TAG_COMPRESSION => {
165                    if val.is_empty() {
166                        return Err(Error::EmptyField(TAG_COMPRESSION));
167                    }
168
169                    if compression.replace(val).is_some() {
170                        return Err(Error::DuplicateField(TAG_COMPRESSION));
171                    }
172                }
173                TAG_FILEHASH => {
174                    let val = val
175                        .strip_prefix("sha256:")
176                        .ok_or(Error::MissingPrefixForHash(TAG_FILEHASH))?;
177                    let val = nixbase32::decode_fixed::<32>(val)
178                        .map_err(|e| Error::UnableToDecodeHash(TAG_FILEHASH, e))?;
179
180                    if file_hash.replace(val).is_some() {
181                        return Err(Error::DuplicateField(TAG_FILEHASH));
182                    }
183                }
184                TAG_FILESIZE => {
185                    let val = val
186                        .parse::<u64>()
187                        .map_err(|_| Error::UnableToParseSize(TAG_FILESIZE, val.to_string()))?;
188
189                    if file_size.replace(val).is_some() {
190                        return Err(Error::DuplicateField(TAG_FILESIZE));
191                    }
192                }
193                TAG_NARHASH => {
194                    let val = val
195                        .strip_prefix("sha256:")
196                        .ok_or(Error::MissingPrefixForHash(TAG_NARHASH))?;
197
198                    let val = if val.len() != HEXLOWER.encode_len(32) {
199                        nixbase32::decode_fixed::<32>(val)
200                    } else {
201                        flags |= Flags::NAR_HASH_HEX;
202
203                        let val = val.as_bytes();
204                        let mut buf = [0u8; 32];
205
206                        HEXLOWER
207                            .decode_mut(val, &mut buf)
208                            .map_err(|e| e.error)
209                            .map(|_| buf)
210                    };
211
212                    let val = val.map_err(|e| Error::UnableToDecodeHash(TAG_NARHASH, e))?;
213
214                    if nar_hash.replace(val).is_some() {
215                        return Err(Error::DuplicateField(TAG_NARHASH));
216                    }
217                }
218                TAG_NARSIZE => {
219                    let val = val
220                        .parse::<u64>()
221                        .map_err(|_| Error::UnableToParseSize(TAG_NARSIZE, val.to_string()))?;
222
223                    if nar_size.replace(val).is_some() {
224                        return Err(Error::DuplicateField(TAG_NARSIZE));
225                    }
226                }
227                TAG_REFERENCES => {
228                    let val: Vec<StorePathRef> = if !val.is_empty() {
229                        let mut prev = "";
230                        val.split(' ')
231                            .enumerate()
232                            .map(|(i, s)| {
233                                // TODO(edef): track *duplicates* if this occurs
234                                if mem::replace(&mut prev, s) >= s {
235                                    flags |= Flags::REFERENCES_OUT_OF_ORDER;
236                                }
237
238                                StorePathRef::from_bytes(s.as_bytes())
239                                    .map_err(|err| Error::InvalidReference(i, err))
240                            })
241                            .collect::<Result<_, _>>()?
242                    } else {
243                        vec![]
244                    };
245
246                    if references.replace(val).is_some() {
247                        return Err(Error::DuplicateField(TAG_REFERENCES));
248                    }
249                }
250                TAG_SYSTEM => {
251                    if val.is_empty() {
252                        return Err(Error::EmptyField(TAG_SYSTEM));
253                    }
254
255                    if system.replace(val).is_some() {
256                        return Err(Error::DuplicateField(TAG_SYSTEM));
257                    }
258                }
259                TAG_DERIVER => {
260                    match val.strip_suffix(".drv") {
261                        Some(val) => {
262                            let val = StorePathRef::from_bytes(val.as_bytes())
263                                .map_err(Error::InvalidDeriverStorePath)?;
264
265                            if deriver.replace(val).is_some() {
266                                return Err(Error::DuplicateField(TAG_DERIVER));
267                            }
268                        }
269                        None => {
270                            if val == "unknown-deriver" {
271                                flags |= Flags::EXPLICIT_UNKNOWN_DERIVER;
272                            } else {
273                                return Err(Error::InvalidDeriverStorePathMissingSuffix);
274                            }
275                        }
276                    };
277                }
278                TAG_SIG => {
279                    let val = SignatureRef::parse(val)
280                        .map_err(|e| Error::UnableToParseSignature(signatures.len(), e))?;
281
282                    signatures.push(val);
283                }
284                TAG_CA => {
285                    let val = CAHash::from_nix_hex_str(val)
286                        .ok_or_else(|| Error::UnableToParseCA(val.to_string()))?;
287
288                    if ca.replace(val).is_some() {
289                        return Err(Error::DuplicateField(TAG_CA));
290                    }
291                }
292                _ => {
293                    flags |= Flags::UNKNOWN_FIELD;
294                }
295            }
296        }
297
298        Ok(NarInfo {
299            store_path: store_path.ok_or(Error::MissingField("StorePath"))?,
300            nar_hash: nar_hash.ok_or(Error::MissingField("NarHash"))?,
301            nar_size: nar_size.ok_or(Error::MissingField("NarSize"))?,
302            references: match references {
303                Some(val) => val,
304                None => {
305                    flags |= Flags::REFERENCES_MISSING;
306                    vec![]
307                }
308            },
309            signatures,
310            ca,
311            system,
312            deriver,
313            url: url.ok_or(Error::MissingField("URL"))?,
314            compression: match compression {
315                Some("none") => None,
316                None => {
317                    flags |= Flags::COMPRESSION_DEFAULT;
318                    Some("bzip2")
319                }
320                _ => compression,
321            },
322            file_hash,
323            file_size,
324            flags,
325        })
326    }
327
328    /// Computes the fingerprint string for certain fields in this [NarInfo].
329    /// This fingerprint is signed in [self.signatures].
330    pub fn fingerprint(&self) -> String {
331        fingerprint(
332            &self.store_path,
333            &self.nar_hash,
334            self.nar_size,
335            self.references.iter(),
336        )
337    }
338
339    /// Adds a signature, using the passed signer to sign.
340    /// This is generic over algo implementations / providers,
341    /// so users can bring their own signers.
342    pub fn add_signature<S>(&mut self, signer: &'a SigningKey<S>)
343    where
344        S: ed25519::signature::Signer<ed25519::Signature>,
345    {
346        // calculate the fingerprint to sign
347        let fp = self.fingerprint();
348
349        let sig = signer.sign(fp.as_bytes());
350
351        self.signatures.push(sig);
352    }
353}
354
355impl Display for NarInfo<'_> {
356    fn fmt(&self, w: &mut fmt::Formatter) -> fmt::Result {
357        writeln!(w, "StorePath: /nix/store/{}", self.store_path)?;
358        writeln!(w, "URL: {}", self.url)?;
359
360        if !self.flags.contains(Flags::COMPRESSION_DEFAULT) {
361            let compression = self.compression.unwrap_or("none");
362            writeln!(w, "Compression: {compression}")?;
363        };
364
365        if let Some(file_hash) = self.file_hash {
366            writeln!(w, "FileHash: sha256:{}", nixbase32::encode(&file_hash),)?;
367        }
368
369        if let Some(file_size) = self.file_size {
370            writeln!(w, "FileSize: {file_size}")?;
371        }
372
373        writeln!(w, "NarHash: sha256:{}", nixbase32::encode(&self.nar_hash),)?;
374        writeln!(w, "NarSize: {}", self.nar_size)?;
375
376        if !self.flags.contains(Flags::REFERENCES_MISSING) {
377            write!(w, "References:")?;
378            if self.references.is_empty() {
379                write!(w, " ")?;
380            } else {
381                for path in &self.references {
382                    write!(w, " {path}")?;
383                }
384            }
385            writeln!(w)?;
386        }
387
388        if let Some(deriver) = &self.deriver {
389            writeln!(w, "Deriver: {deriver}.drv")?;
390        } else if self.flags.contains(Flags::EXPLICIT_UNKNOWN_DERIVER) {
391            writeln!(w, "Deriver: unknown-deriver")?;
392        }
393
394        if let Some(system) = self.system {
395            writeln!(w, "System: {system}")?;
396        }
397
398        for sig in &self.signatures {
399            writeln!(w, "Sig: {sig}")?;
400        }
401
402        if let Some(ca) = &self.ca {
403            writeln!(w, "CA: {}", ca)?;
404        }
405
406        Ok(())
407    }
408}
409
410#[derive(thiserror::Error, Debug)]
411pub enum Error {
412    #[error("duplicate field: {0}")]
413    DuplicateField(&'static str),
414
415    #[error("missing field: {0}")]
416    MissingField(&'static str),
417
418    #[error("invalid line: {0}")]
419    InvalidLine(String),
420
421    #[error("invalid StorePath: {0}")]
422    InvalidStorePath(ParseStorePathError),
423
424    #[error("field {0} may not be empty string")]
425    EmptyField(&'static str),
426
427    #[error("invalid {0}: {1}")]
428    UnableToParseSize(&'static str, String),
429
430    #[error("unable to parse #{0} reference: {1}")]
431    InvalidReference(usize, ParseStorePathError),
432
433    #[error("invalid Deriver store path: {0}")]
434    InvalidDeriverStorePath(ParseStorePathError),
435
436    #[error("invalid Deriver store path, must end with .drv")]
437    InvalidDeriverStorePathMissingSuffix,
438
439    #[error("missing prefix for {0}")]
440    MissingPrefixForHash(&'static str),
441
442    #[error("unable to decode {0}: {1}")]
443    UnableToDecodeHash(&'static str, data_encoding::DecodeError),
444
445    #[error("unable to parse signature #{0}: {1}")]
446    UnableToParseSignature(usize, SignatureError),
447
448    #[error("unable to parse CA field: {0}")]
449    UnableToParseCA(String),
450}
451
452#[cfg(test)]
453const DUMMY_KEYPAIR: &str = "cache.example.com-1:cCta2MEsRNuYCgWYyeRXLyfoFpKhQJKn8gLMeXWAb7vIpRKKo/3JoxJ24OYa3DxT2JVV38KjK/1ywHWuMe2JEw==";
454#[cfg(test)]
455const DUMMY_VERIFYING_KEY: &str =
456    "cache.example.com-1:yKUSiqP9yaMSduDmGtw8U9iVVd/Coyv9csB1rjHtiRM=";
457
458#[cfg(test)]
459mod test {
460    use hex_literal::hex;
461    use pretty_assertions::assert_eq;
462    use std::sync::LazyLock;
463    use std::{io, str};
464
465    use crate::{
466        nixhash::{CAHash, NixHash},
467        store_path::StorePathRef,
468    };
469
470    use super::{Flags, NarInfo};
471
472    static CASES: LazyLock<&'static [&'static str]> = LazyLock::new(|| {
473        let data = zstd::decode_all(io::Cursor::new(include_bytes!(
474            "../../testdata/narinfo.zst"
475        )))
476        .unwrap();
477        let data = str::from_utf8(Vec::leak(data)).unwrap();
478        Vec::leak(
479            data.split_inclusive("\n\n")
480                .map(|s| s.strip_suffix('\n').unwrap())
481                .collect::<Vec<_>>(),
482        )
483    });
484
485    #[test]
486    fn roundtrip() {
487        for &input in *CASES {
488            let parsed = NarInfo::parse(input).expect("should parse");
489            let output = format!("{parsed}");
490            assert_eq!(input, output, "should roundtrip");
491        }
492    }
493
494    #[test]
495    fn references_out_of_order() {
496        let parsed = NarInfo::parse(
497            r#"StorePath: /nix/store/xi429w4ddvb1r77978hm7jfb2jsn559r-gcc-3.4.6
498URL: nar/1hr09cgkyw1hcsfkv5qp5jlpmf2mqrkrqs3xj5zklq9c1h9544ff.nar.bz2
499Compression: bzip2
500FileHash: sha256:1hr09cgkyw1hcsfkv5qp5jlpmf2mqrkrqs3xj5zklq9c1h9544ff
501FileSize: 4006
502NarHash: sha256:0ik9mpqxpd9hv325hdblj2nawqj5w7951qdyy8ikxgwr6fq7m11c
503NarSize: 21264
504References: a8922c0h87iilxzzvwn2hmv8x210aqb9-glibc-2.7 7w2acjgalb0cm7b3bg8yswza4l7iil9y-binutils-2.18 mm631h09mj964hm9q04l5fd8vw12j1mm-bash-3.2-p39 nx2zs2qd6snfcpzw4a0jnh26z9m0yihz-gcc-3.4.6 xi429w4ddvb1r77978hm7jfb2jsn559r-gcc-3.4.6
505Deriver: 2dzpn70c1hawczwhg9aavqk18zp9zsva-gcc-3.4.6.drv
506Sig: cache.nixos.org-1:o1DTsjCz0PofLJ216P2RBuSulI8BAb6zHxWE4N+tzlcELk5Uk/GO2SCxWTRN5wJutLZZ+cHTMdWqOHF88KGQDg==
507"#).expect("should parse");
508
509        assert!(parsed.flags.contains(Flags::REFERENCES_OUT_OF_ORDER));
510        assert_eq!(
511            vec![
512                "a8922c0h87iilxzzvwn2hmv8x210aqb9-glibc-2.7",
513                "7w2acjgalb0cm7b3bg8yswza4l7iil9y-binutils-2.18",
514                "mm631h09mj964hm9q04l5fd8vw12j1mm-bash-3.2-p39",
515                "nx2zs2qd6snfcpzw4a0jnh26z9m0yihz-gcc-3.4.6",
516                "xi429w4ddvb1r77978hm7jfb2jsn559r-gcc-3.4.6"
517            ],
518            parsed
519                .references
520                .iter()
521                .map(StorePathRef::to_string)
522                .collect::<Vec<_>>(),
523        );
524    }
525
526    #[test]
527    fn ca_nar_hash_sha1() {
528        // be explicit with the trailing whitespace to prevent editors from stripping it out
529        let input = {
530            let input = r#"StorePath: /nix/store/k20pahypzvr49fy82cw5sx72hdfg3qcr-texlive-hyphenex-37354
531URL: nar/0i5biw0g01514llhfswxy6xfav8lxxdq1xg6ik7hgsqbpw0f06yi.nar.xz
532Compression: xz
533FileHash: sha256:0i5biw0g01514llhfswxy6xfav8lxxdq1xg6ik7hgsqbpw0f06yi
534FileSize: 7120
535NarHash: sha256:0h1bm4sj1cnfkxgyhvgi8df1qavnnv94sd0v09wcrm971602shfg
536NarSize: 22552
537References:!!WSP!!
538Sig: cache.nixos.org-1:u01BybwQhyI5H1bW1EIWXssMDhDDIvXOG5uh8Qzgdyjz6U1qg6DHhMAvXZOUStIj6X5t4/ufFgR8i3fjf0bMAw==
539CA: fixed:r:sha1:1ak1ymbmsfx7z8kh09jzkr3a4dvkrfjw
540"#;
541            input.replace("!!WSP!!", " ")
542        };
543        let parsed = NarInfo::parse(&input).expect("should parse");
544
545        assert_eq!(
546            parsed.ca,
547            Some(CAHash::Nar(NixHash::Sha1(hex!(
548                "5cba3c77236ae4f9650270a27fbad375551fa60a"
549            ))))
550        );
551    }
552
553    #[test]
554    fn compression_default() {
555        // This doesn't exist as such in cache.nixos.org.
556        // We explicitly removed the compression field for the sake of this test.
557        let input = r#"StorePath: /nix/store/a1jjalr4csx9hcga7fnm122aqabrjnch-digikam-2.6.0
558URL: nar/1fzimfnvq2k8b40n4g54abmncpx2ddckh6qlb77pgq6xiysyil69.nar.bz2
559FileHash: sha256:1fzimfnvq2k8b40n4g54abmncpx2ddckh6qlb77pgq6xiysyil69
560FileSize: 43503778
561NarHash: sha256:0zpbbwipqzr5p8mlpag9wrsp5hlaxkq7gax5jj0hg3vvdziypcw5
562NarSize: 100658640
563References: 0izkyk7bq2ag9393nvnhgm87p75cq09w-liblqr-1-0.4.1 1cslpgyb7vb30inj3210jv6agqv42jxz-qca-2.0.3 1sya3bwjxkzpkmwn67gfzp4gz4g62l36-libXrandr-1.3.1 26yxdaa9z0ma5sgw02i670rsqnl57crs-glib-2.30.3 27lnjh99236kmhbpc5747599zcymfzmg-qt-4.8.2 2v6x378vcfvyxilkvihs60zha54z2x2y-qjson-0.7.1 45hgr3fbnr45n795hn2x7hsymp0h2j2m-libjpeg-8c 4kw1b212s80ap2iyibxrimcqb5imhfj7-libkexiv2-4.7.4 7dvylm5crlc0sfafcc0n46mb5ch67q0j-glibc-2.13 a05cbh1awjbl1rbyb2ynyf4k42v5a9a7-boost-1.47.0 a1jjalr4csx9hcga7fnm122aqabrjnch-digikam-2.6.0 aav5ffg8wlnilgnvdb2jnrv2aam4zmmz-perl-5.14.2 ab0m9h30nsr13w48qriv0k350kmwx567-kdelibs-4.7.4 avffkd49cqvpwdkzry8bn69dkbw4cy29-lensfun-0.2.5 cy8rl8h4yp2j3h8987vkklg328q3wmjz-gcc-4.6.3 dmmh5ihyg1r2dm4azgsfj2kprj92czlg-libSM-1.2.0 fl56j5n4shfw9c0r6vs2i4f1h9zx5kac-soprano-2.7.6 g15cmvh15ggdjcwapskngv20q4yhix40-jasper-1.900.1 i04maxd0din6v92rnqcwl9yra0kl2vk5-marble-4.7.4 kqjjb3m26rdddwwwkk8v45821aps877k-libICE-1.0.7 lxz9r135wkndvi642z4bjgmvyypsgirb-libtiff-3.9.4 m9c8i0a6cl30lcqp654dqkbag3wjmd00-libX11-1.4.1 mpnj4k2ijrgyfkh48fg96nzcmklfh5pl-coreutils-8.15 nppljblap477s0893c151lyq7r7n5v1q-zlib-1.2.7 nw9mdbyp8kyn3v4vkdzq0gsnqbc4mnx3-expat-2.0.1 p1a0dn931mzdkvj6h5yzshbmgxba5r0z-libgphoto2-2.4.11 pvjj07xa1cfkad3gwk376nzdrgknbcqm-mesa-7.11.2 pzcxag98jqccp9ycbxknyh0w95pgnsk4-lcms-1.19 qfi5pgds33kg6vlnxsmj0hyl74vcmyiz-libpng-1.5.10 scm6bj86s3qh3s3x0b9ayjp6755p4q86-mysql-5.1.54 sd23qspcyg385va0lr35xgz3hvlqphg6-libkipi-4.7.4 svmbrhc6kzfzakv20a7zrfl6kbr5mfpq-kdepimlibs-4.7.4 v7kh3h7xfwjz4hgffg3gwrfzjff9bw9d-bash-4.2-p24 vi17f22064djgpk0w248da348q8gxkww-libkdcraw-4.7.4 wkjdzmj3z4dcbsc9f833zs6krdgg2krk-phonon-4.6.0 xf3i3awqi0035ixy2qyb6hk4c92r3vrn-opencv-2.4.2 y1vr0nz8i59x59501020nh2k1dw3bhwq-libusb-0.1.12 yf3hin2hb6i08n7zrk8g3acy54rhg9bp-libXext-1.2.0
564Deriver: la77dr44phk5m5jnl4dvk01cwpykyw9s-digikam-2.6.0.drv
565System: i686-linux
566Sig: cache.nixos.org-1:92fl0i5q7EyegCj5Yf4L0bENkWuVAtgveiRcTEEUH0P6HvCE1xFcPbz/0Pf6Np+K1LPzHK+s5RHOmVoxRsvsDg==
567"#;
568        let parsed = NarInfo::parse(input).expect("should parse");
569
570        assert!(parsed.flags.contains(Flags::COMPRESSION_DEFAULT));
571        assert_eq!(parsed.compression, Some("bzip2"));
572        assert_eq!(parsed.to_string(), input);
573    }
574
575    #[test]
576    fn compression_none() {
577        // This doesn't exist as such in cache.nixos.org.
578        // We explicitly changed the Compression, FileHash and FileSize fields for the sake of this test.
579        let input = r#"StorePath: /nix/store/a1jjalr4csx9hcga7fnm122aqabrjnch-digikam-2.6.0
580URL: nar/1fzimfnvq2k8b40n4g54abmncpx2ddckh6qlb77pgq6xiysyil69.nar.bz2
581Compression: none
582FileHash: sha256:0zpbbwipqzr5p8mlpag9wrsp5hlaxkq7gax5jj0hg3vvdziypcw5
583FileSize: 100658640
584NarHash: sha256:0zpbbwipqzr5p8mlpag9wrsp5hlaxkq7gax5jj0hg3vvdziypcw5
585NarSize: 100658640
586References: 0izkyk7bq2ag9393nvnhgm87p75cq09w-liblqr-1-0.4.1 1cslpgyb7vb30inj3210jv6agqv42jxz-qca-2.0.3 1sya3bwjxkzpkmwn67gfzp4gz4g62l36-libXrandr-1.3.1 26yxdaa9z0ma5sgw02i670rsqnl57crs-glib-2.30.3 27lnjh99236kmhbpc5747599zcymfzmg-qt-4.8.2 2v6x378vcfvyxilkvihs60zha54z2x2y-qjson-0.7.1 45hgr3fbnr45n795hn2x7hsymp0h2j2m-libjpeg-8c 4kw1b212s80ap2iyibxrimcqb5imhfj7-libkexiv2-4.7.4 7dvylm5crlc0sfafcc0n46mb5ch67q0j-glibc-2.13 a05cbh1awjbl1rbyb2ynyf4k42v5a9a7-boost-1.47.0 a1jjalr4csx9hcga7fnm122aqabrjnch-digikam-2.6.0 aav5ffg8wlnilgnvdb2jnrv2aam4zmmz-perl-5.14.2 ab0m9h30nsr13w48qriv0k350kmwx567-kdelibs-4.7.4 avffkd49cqvpwdkzry8bn69dkbw4cy29-lensfun-0.2.5 cy8rl8h4yp2j3h8987vkklg328q3wmjz-gcc-4.6.3 dmmh5ihyg1r2dm4azgsfj2kprj92czlg-libSM-1.2.0 fl56j5n4shfw9c0r6vs2i4f1h9zx5kac-soprano-2.7.6 g15cmvh15ggdjcwapskngv20q4yhix40-jasper-1.900.1 i04maxd0din6v92rnqcwl9yra0kl2vk5-marble-4.7.4 kqjjb3m26rdddwwwkk8v45821aps877k-libICE-1.0.7 lxz9r135wkndvi642z4bjgmvyypsgirb-libtiff-3.9.4 m9c8i0a6cl30lcqp654dqkbag3wjmd00-libX11-1.4.1 mpnj4k2ijrgyfkh48fg96nzcmklfh5pl-coreutils-8.15 nppljblap477s0893c151lyq7r7n5v1q-zlib-1.2.7 nw9mdbyp8kyn3v4vkdzq0gsnqbc4mnx3-expat-2.0.1 p1a0dn931mzdkvj6h5yzshbmgxba5r0z-libgphoto2-2.4.11 pvjj07xa1cfkad3gwk376nzdrgknbcqm-mesa-7.11.2 pzcxag98jqccp9ycbxknyh0w95pgnsk4-lcms-1.19 qfi5pgds33kg6vlnxsmj0hyl74vcmyiz-libpng-1.5.10 scm6bj86s3qh3s3x0b9ayjp6755p4q86-mysql-5.1.54 sd23qspcyg385va0lr35xgz3hvlqphg6-libkipi-4.7.4 svmbrhc6kzfzakv20a7zrfl6kbr5mfpq-kdepimlibs-4.7.4 v7kh3h7xfwjz4hgffg3gwrfzjff9bw9d-bash-4.2-p24 vi17f22064djgpk0w248da348q8gxkww-libkdcraw-4.7.4 wkjdzmj3z4dcbsc9f833zs6krdgg2krk-phonon-4.6.0 xf3i3awqi0035ixy2qyb6hk4c92r3vrn-opencv-2.4.2 y1vr0nz8i59x59501020nh2k1dw3bhwq-libusb-0.1.12 yf3hin2hb6i08n7zrk8g3acy54rhg9bp-libXext-1.2.0
587Deriver: la77dr44phk5m5jnl4dvk01cwpykyw9s-digikam-2.6.0.drv
588System: i686-linux
589Sig: cache.nixos.org-1:92fl0i5q7EyegCj5Yf4L0bENkWuVAtgveiRcTEEUH0P6HvCE1xFcPbz/0Pf6Np+K1LPzHK+s5RHOmVoxRsvsDg==
590"#;
591        let parsed = NarInfo::parse(input).expect("should parse");
592
593        assert!(!parsed.flags.contains(Flags::COMPRESSION_DEFAULT));
594        assert_eq!(parsed.compression, None);
595        assert_eq!(parsed.to_string(), input);
596    }
597
598    #[test]
599    fn explicit_unknown_deriver() {
600        // This is a NARInfo "produced by a legacy tool" according to Nix commit
601        // c60715e937e3773bbb8a114fc9b9c6577f8c5cb5
602        let input = r#"StorePath: /nix/store/00bgd045z0d4icpbc2yyz4gx48ak44la-net-tools-1.60_p20170221182432
603URL: nar/1094wph9z4nwlgvsd53abfz8i117ykiv5dwnq9nnhz846s7xqd7d.nar.xz
604Compression: xz
605FileHash: sha256:1094wph9z4nwlgvsd53abfz8i117ykiv5dwnq9nnhz846s7xqd7d
606FileSize: 114980
607NarHash: sha256:0lxjvvpr59c2mdram7ympy5ay741f180kv3349hvfc3f8nrmbqf6
608NarSize: 464152
609References: 7gx4kiv5m0i7d7qkixq2cwzbr10lvxwc-glibc-2.27
610Deriver: unknown-deriver
611Sig: cache.nixos.org-1:sn5s/RrqEI+YG6/PjwdbPjcAC7rcta7sJU4mFOawGvJBLsWkyLtBrT2EuFt/LJjWkTZ+ZWOI9NTtjo/woMdvAg==
612Sig: hydra.other.net-1:JXQ3Z/PXf0EZSFkFioa4FbyYpbbTbHlFBtZf4VqU0tuMTWzhMD7p9Q7acJjLn3jofOtilAAwRILKIfVuyrbjAA==
613"#;
614        let parsed = NarInfo::parse(input).expect("should parse");
615
616        assert!(parsed.flags.contains(Flags::EXPLICIT_UNKNOWN_DERIVER));
617        assert!(parsed.deriver.is_none());
618        assert_eq!(parsed.to_string(), input);
619    }
620
621    #[test]
622    fn nar_hash_hex() {
623        let parsed = NarInfo::parse(r#"StorePath: /nix/store/0vpqfxbkx0ffrnhbws6g9qwhmliksz7f-perl-HTTP-Cookies-6.01
624URL: nar/1rv1m9inydm1r4krw8hmwg1hs86d0nxddd1pbhihx7l7fycjvfk3.nar.xz
625Compression: xz
626FileHash: sha256:1rv1m9inydm1r4krw8hmwg1hs86d0nxddd1pbhihx7l7fycjvfk3
627FileSize: 19912
628NarHash: sha256:60adfd293a4d81ad7cd7e47263cbb3fc846309ef91b154a08ba672b558f94ff3
629NarSize: 45840
630References: 0vpqfxbkx0ffrnhbws6g9qwhmliksz7f-perl-HTTP-Cookies-6.01 9vrhbib2lxd9pjlg6fnl5b82gblidrcr-perl-HTTP-Message-6.06 wy20zslqxzxxfpzzk0rajh41d7a6mlnf-perl-HTTP-Date-6.02
631Deriver: fb4ihlq3psnsjq95mvvs49rwpplpc8zj-perl-HTTP-Cookies-6.01.drv
632Sig: cache.nixos.org-1:HhaiY36Uk3XV1JGe9d9xHnzAapqJXprU1YZZzSzxE97jCuO5RR7vlG2kF7MSC5thwRyxAtdghdSz3AqFi+QSCw==
633"#).expect("should parse");
634
635        assert!(parsed.flags.contains(Flags::NAR_HASH_HEX));
636        assert_eq!(
637            hex!("60adfd293a4d81ad7cd7e47263cbb3fc846309ef91b154a08ba672b558f94ff3"),
638            parsed.nar_hash,
639        );
640    }
641
642    #[test]
643    fn references_missing() {
644        // This is a NARInfo without a References field.
645        // This NARInfo was produced by harmonia (but the signature was altered).
646        let input = r#"StorePath: /nix/store/64s9zav4fk5qiba1jq0ipvyhnn57r7dq-cfg-if-1.0.0
647URL: nar/0lxxfhy5fmfz0sbnqkqjdf7gx9gsxrfzz49n19y8sr93inawhshh.nar?hash=64s9zav4fk5qiba1jq0ipvyhnn57r7dq
648Compression: none
649FileHash: sha256:0lxxfhy5fmfz0sbnqkqjdf7gx9gsxrfzz49n19y8sr93inawhshh
650FileSize: 24944
651NarHash: sha256:0lxxfhy5fmfz0sbnqkqjdf7gx9gsxrfzz49n19y8sr93inawhshh
652NarSize: 24944
653Deriver: s409kxiz6bx2g0da01gzvlnnjpl3i4h9-cfg-if-1.0.0.drv
654Sig: cache.nixos.org-1:WDvKIdxSnQ8p2w9SD0ffdibUSNMz6QQN6jpe+A8LLNHmZFsX+m8GZF0x9DN6PWV6k+OlnBT5UVbiWQYgXIsQAQ==
655"#;
656        let parsed = NarInfo::parse(input).expect("should parse");
657
658        assert!(parsed.flags.contains(Flags::REFERENCES_MISSING));
659        assert_eq!(parsed.references, vec![]);
660        assert_eq!(parsed.to_string(), input);
661    }
662
663    /// Adds a signature to a NARInfo, using key material parsed from DUMMY_KEYPAIR.
664    /// It then ensures signature verification with the parsed
665    /// DUMMY_VERIFYING_KEY succeeds.
666    #[test]
667    fn sign() {
668        // be explicit with the trailing whitespace to prevent editors from stripping it out
669        let input = {
670            let input = r#"StorePath: /nix/store/0vpqfxbkx0ffrnhbws6g9qwhmliksz7f-perl-HTTP-Cookies-6.01
671URL: nar/0i5biw0g01514llhfswxy6xfav8lxxdq1xg6ik7hgsqbpw0f06yi.nar.xz
672Compression: xz
673FileHash: sha256:0i5biw0g01514llhfswxy6xfav8lxxdq1xg6ik7hgsqbpw0f06yi
674FileSize: 7120
675NarHash: sha256:0h1bm4sj1cnfkxgyhvgi8df1qavnnv94sd0v09wcrm971602shfg
676NarSize: 22552
677References:!!WSP!!
678CA: fixed:r:sha1:1ak1ymbmsfx7z8kh09jzkr3a4dvkrfjw
679"#;
680            input.replace("!!WSP!!", " ")
681        };
682        let mut narinfo = NarInfo::parse(&input).expect("should parse");
683
684        let fp = narinfo.fingerprint();
685
686        // load our keypair from the fixtures
687        let (signing_key, _verifying_key) =
688            super::parse_keypair(super::DUMMY_KEYPAIR).expect("must succeed");
689
690        // add signature
691        narinfo.add_signature(&signing_key);
692
693        // ensure the signature is added
694        let new_sig = narinfo.signatures.last().unwrap();
695        assert_eq!(signing_key.name(), *new_sig.name());
696
697        // verify the new signature against the verifying key
698        let verifying_key = super::VerifyingKey::parse(super::DUMMY_VERIFYING_KEY)
699            .expect("parsing dummy verifying key");
700
701        assert!(
702            verifying_key.verify(&fp, new_sig),
703            "expect signature to be valid"
704        );
705    }
706}
nix_compat/narinfo/mod.rs

nix_compat/narinfo/
mod.rs
