guix/nix/libstore/store-api.hh, branch kernel-updates

daemon: Bypass authentication when importing content-addressed store items.

2026-08-17T14:47:36+00:00

This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein 
Signed-off-by: Ludovic Courtès 
Merges: #8979

daemon: Remove ‘requireSignature’ argument to ‘importPaths’.

2026-08-17T14:47:35+00:00

For ‘guix-daemon’ the value of ‘requireSignature’ has always been true.

* nix/libstore/store-api.hh (StoreAPI)[importPaths]: Remove ‘requireSignature’
argument.
* nix/libstore/local-store.hh (LocalStore)[importPaths]: Likewise.
* nix/libstore/local-store.cc (LocalStore::importPaths): Adjust accordingly.
* nix/nix-daemon/nix-daemon.cc (performOp): Remove first argument to
‘importPaths’.

Change-Id: I7ed87f3af03cca7078e224788114c499773f01c2
Signed-off-by: Ludovic Courtès

daemon: libstore: add assertStorePathStrict and helpers.

2026-06-24T13:20:16+00:00

isStorePath is a lightweight check that only verifies that the given path is
in the store and doesn't have any '/' characters after the store prefix.  This
is insufficiently strict for verifying that a given path is actually a valid
store path.

isStoreName is extracted from checkStoreName, and to preserve the error
messages may have a second argument giving a string to write to with the
problem description in the case that isStoreName returns false.

* nix/libstore/store-api.hh (assertStorePathStrict, isStoreName,
  isStoreBasenameStrict, isStorePathStrict): new functions.
* nix/libstore/worker-protocol.hh (readStorePathStrict): new function.
  (readStorePathsStrict): new template.
* nix/libstore/store-api.cc (assertStorePathStrict, isStoreName,
  isStoreBasenameStrict, isStorePathStrict, readStorePathStrict,
  readStorePathsStrict): provide implementations.

Signed-off-by: Ludovic Courtès

nix: Spelling corrections.

2026-01-14T08:16:45+00:00

* nix/libstore/globals.hh,
nix/libstore/store-api.hh,
nix/libutil/util.hh: Fix misspellings in comments.

Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8

daemon: Use inline functions and variables instead of extern

2025-11-12T17:34:06+00:00

Avoid separate declarations and definitions for so-called 'global' objects.

* nix/libstore/derivations.{cc, hh} (drvHashes): Use inline instead of separate
declaration and definition.
* nix/libstore/globals.{cc, hh} (settings, nixVersion): Same.
* nix/libstore/local-store.hh (drvsLogDir, deduplicationMinSize): Same.
* nix/libstore/optimise-store.cc (deduplicationMinSize): Same.
* nix/libstore/store-api.{cc, hh} (store): Same.
* nix/libutil/archive.{cc, hh} (defaultPathFilter): Same.
* nix/libutil/hash.{cc, hh} (base32Chars): Same and modify header files.
* nix/libutil/util.{cc, hh} (logType, verbosity, _writeToStderr,
_isInterrupted): Same.
* nix/local.mk: Modified according to the rename of shared.hh.
* nix/nix-daemon/guix-daemon.cc (blockInt, argvSaved, run): Same and
modify header files.
* nix/nix-daemon/nix-daemon.cc: Modify header files.
* nix/nix-daemon/shared.hh: Renamed to nix-daemon.hh

Signed-off-by: Ludovic Courtès

daemon: Fix build failure with gcc@15.

2025-06-01T14:01:03+00:00

* nix/libstore/build.cc (CompareGoalPtrs::operator): Add const keyword.
* nix/libstore/store-api.hh: Add missing include for uint64_t.

Change-Id: I56368da9eb10dc376f7e6eeae6a61746bb36c9cf
Signed-off-by: Andreas Enge

daemon: Remove unused function exportPaths.

2022-09-11T14:43:30+00:00

* nix/libstore/store-api.cc (exportPaths): Remove it.
* nix/libstore/store-api.hh (exportPaths): Likewise.

Signed-off-by: Mathieu Othacehe

daemon: Remove unused function openStore.

2022-09-11T14:43:30+00:00

* nix/libstore/store-api.cc (openStore): Remove it.
* nix/libstore/store-api.hh (openStore): Likewise.

Signed-off-by: Mathieu Othacehe

daemon: Make 'profiles/per-user' non-world-writable.

2019-10-16T20:53:40+00:00

Fixes .
Reported at .

Based on Nix commit 5a303093dcae1e5ce9212616ef18f2ca51020b0d
by Eelco Dolstra .

* nix/libstore/local-store.cc (LocalStore::LocalStore): Set 'perUserDir'
to #o755 instead of #o1777.
(LocalStore::createUser): New function.
* nix/libstore/local-store.hh (LocalStore): Add it.
* nix/libstore/store-api.hh (StoreAPI): Add it.
* nix/nix-daemon/nix-daemon.cc (performOp): In 'wopSetOptions', add
condition to handle "user-name" property and honor it.
(processConnection): Add 'userId' parameter.  Call 'store->createUser'
when userId is not -1.
* guix/profiles.scm (ensure-profile-directory): Note that this is now
handled by the daemon.
* guix/store.scm (current-user-name): New procedure.
(set-build-options): Add #:user-name parameter and pass it to the daemon.
* tests/guix-daemon.sh: Test the creation of 'profiles/per-user' when
listening on a TCP socket.
* tests/store.scm ("profiles/per-user exists and is not writable")
("profiles/per-user/$USER exists"): New tests.

Remove 'guix-register' and its traces.

2018-06-14T09:17:00+00:00

* Makefile.am (SH_TESTS): Remove tests/guix-register.sh.
* build-aux/pre-inst-env.in (GUIX_REGISTER): Remove.
* gnu/build/install.scm (directives): Remove outdated comment.
* gnu/build/vm.scm (root-partition-initializer): Update comment.
* gnu/packages/package-management.scm (guix-register): Remove.
* guix/config.scm.in (%sbindir, %guix-register-program): Remove.
* guix/scripts/system.scm (install): Adjust docstring.
* guix/self.scm (make-config.scm): Remove #:guix.  Do not generate
%sbindir and %guix-register-program.
(specification->package): Remove "guix".
* nix/guix-register/guix-register.cc: Remove.
* nix/libstore/store-api.cc (decodeValidPathInfo): Remove.
* nix/libstore/store-api.hh (decodeValidPathInfo): Remove declaration.
* nix/local.mk (sbin_PROGRAMS, guix_register_SOURCES)
(guix_register_CPPFLAGS, guix_register_LDFLAGS): Remove.
* tests/guix-register.sh: Remove.