guix/nix/libutil, branch ruby-team Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org daemon: Bypass authentication when importing content-addressed store items. 2026-08-17T14:47:36+00:00 Ludovic Courtès ludo@gnu.org 2026-05-30T21:54:05+00:00 64d4de2a920445e5992f020e56490f5fcbdbba7c This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since the two latter RPCs let anyone add content-addressed items in the store, there’s no reason for ‘importPaths’ to require signatures by authorized keys on these content-addressed items. This will allow for things like ‘guix copy’ of .drv items without authorization, or ‘guix deploy’ with (build-locally? #f) without authorization. * nix/libstore/store-api.hh (isContentAddressedPath): New prototype. * nix/libstore/store-api.cc (isContentAddressedPath): New function. * nix/libutil/util.hh (isPlainFile): New prototype. * nix/libutil/util.cc (isPlainFile): New function. * nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and ‘contentAddressed’. Allow unsigned imports when ‘contentAddressed’ is true; bypass signature verification when ‘contentAddressed’ is true. * tests/store.scm ("import not signed"): Rewrite to not use a content-addressed store item. ("import signed by unauthorized key"): Likewise. ("import not signed but content-addressed tree"): New test. ("import not signed but content-addressed regular file"): New test. ("import signed by unauthorized key but content-addressed"): New test. ("import with corrupt signature"): New test. ("import signed by authorized key but hash doesn't match"): New test. ("import with corrupt signature but content-addressed"): New test. ("import signed by authorized key, hash doesn't match, but content-addressed"): New test. * doc/guix.texi (Invoking guix archive): Document the exception for content-addressed store items. Add anchor for ‘--authorize’. (Invoking guix deploy): Document the benefit of (build-locally? #f). Add cross-reference for ‘authorize?’. Co-authored-by: Reepca Russelstein <reepca@russelstein.xyz> Signed-off-by: Ludovic Courtès <ludo@gnu.org> Merges: #8979 
This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8979
daemon: libutil: make nar parser much stricter. 2026-07-02T17:42:47+00:00 Reepca Russelstein reepca@russelstein.xyz 2026-06-16T00:22:37+00:00 3e5c3217f334805531e5db1680d97490999253f7 The prior implementation of 'parse' was, to put it mildly, very accepting of invalid input. This made it very difficult to review its security properties, which ended up relying entirely on the fact that it still didn't allow "/" in directory entry names and that O_CREAT|O_EXCL implicitly causes symlinks to not be followed in the final component, and mkdir and symlink never follow symlinks in the final component, and all of the above throw exceptions when they fail. Some examples of what was allowed prior: 1. Empty archives: "nix-archive-1" "(" ")" 2. Archives with only a type: "nix-archive-1" "(" "type" "regular" ")" 3. Archives of regular files with multiple contents, which would be concatenated (e.g. this has contents "foobar"): "nix-archive-1" "(" "type" "regular" "contents" "foo" "contents" "bar" ")" 4. Archives of directories with multiple entries with the same name, and that aren't sorted: "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "c" "node" "(" ")" ")" "entry" "(" "name" "b" "node" "(" ")" ")" "entry" "(" "name" "b" "node" "(" ")" ")" "entry" "(" "name" "a" "node" "(" ")" ")" ")" 5. Archives of directories with empty entries: "nix-archive-1" "(" "type" "directory" "entry" "(" ")" ")" 6. Archives of directories with entries with no name: "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")" ")" ")" 7. Archives of directories with entries with no node: "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" ")" ")" 7. Archives of directories with entries with multiple names: "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" "node" "(" ")" "name" "b" ")" ")" 8. Archives of directories with entries with multiple nodes: "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")" "node" "(" ")" ")" ")" 9. Archives of directories with entries with multiple names and multiple nodes: "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" "node" "(" ")" "name" "b" "node" "(" ")" ")" ")" Such permissiveness rather defeats the "normalized" part of "Normalized ARchive". Additionally, 'parse' previously used recursion with no explicit depth limit. In practice Linux would still limit the depth to around 2048, since filenames longer than 4096 bytes yield ENAMETOOLONG, but no such restriction exists on Hurd. The permissiveness issue is resolved by rewriting 'parse', and the unbounded recursion issue is resolved by adding a nestLimit parameter so that no more than DIRECTORY_NESTING_LIMIT (currently 256) levels of recursion are used. An alternate implementation that doesn't use recursion, 'parse_unbounded', is included in case it is determined that the nesting limit should be removed, but currently only 'parse' is used. * nix/libutil/archive.cc (parse): rewrite to add nestLimit parameter. (parseDump): pass DIRECTORY_NESTING_LIMIT as nestLimit argument to 'parse'. (parse_unbounded): new function. Change-Id: Ia3c32cc645b609f6ae7f3bcafc491ec0073cbb51 Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
The prior implementation of 'parse' was, to put it mildly, very accepting of
invalid input.  This made it very difficult to review its security properties,
which ended up relying entirely on the fact that it still didn't allow "/" in
directory entry names and that O_CREAT|O_EXCL implicitly causes symlinks to
not be followed in the final component, and mkdir and symlink never follow
symlinks in the final component, and all of the above throw exceptions when
they fail.

Some examples of what was allowed prior:

1. Empty archives:
   "nix-archive-1" "(" ")"
2. Archives with only a type:
   "nix-archive-1" "(" "type" "regular" ")"
3. Archives of regular files with multiple contents, which would be
   concatenated (e.g. this has contents "foobar"):
   "nix-archive-1" "(" "type" "regular" "contents" "foo" "contents" "bar" ")"
4. Archives of directories with multiple entries with the same name, and that
   aren't sorted:
   "nix-archive-1" "(" "type" "directory"
                       "entry" "(" "name" "c" "node" "(" ")" ")"
                       "entry" "(" "name" "b" "node" "(" ")" ")"
                       "entry" "(" "name" "b" "node" "(" ")" ")"
                       "entry" "(" "name" "a" "node" "(" ")" ")" ")"
5. Archives of directories with empty entries:
   "nix-archive-1" "(" "type" "directory" "entry" "(" ")" ")"
6. Archives of directories with entries with no name:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")" ")" ")"
7. Archives of directories with entries with no node:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" ")" ")"
7. Archives of directories with entries with multiple names:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a"
                                                      "node" "(" ")"
                                                      "name" "b" ")" ")"
8. Archives of directories with entries with multiple nodes:
   "nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")"
                                                      "node" "(" ")" ")" ")"
9. Archives of directories with entries with multiple names and multiple
   nodes:
   "nix-archive-1" "(" "type" "directory"
                       "entry" "(" "name" "a" "node" "(" ")"
                                   "name" "b" "node" "(" ")" ")" ")"

Such permissiveness rather defeats the "normalized" part of "Normalized
ARchive".

Additionally, 'parse' previously used recursion with no explicit depth limit.
In practice Linux would still limit the depth to around 2048, since filenames
longer than 4096 bytes yield ENAMETOOLONG, but no such restriction exists on
Hurd.

The permissiveness issue is resolved by rewriting 'parse', and the unbounded
recursion issue is resolved by adding a nestLimit parameter so that no more
than DIRECTORY_NESTING_LIMIT (currently 256) levels of recursion are used.  An
alternate implementation that doesn't use recursion, 'parse_unbounded', is
included in case it is determined that the nesting limit should be removed,
but currently only 'parse' is used.

* nix/libutil/archive.cc (parse): rewrite to add nestLimit parameter.
  (parseDump): pass DIRECTORY_NESTING_LIMIT as nestLimit argument to 'parse'.
  (parse_unbounded): new function.

Change-Id: Ia3c32cc645b609f6ae7f3bcafc491ec0073cbb51
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: libutil: add isHash32. 2026-06-24T13:20:16+00:00 Reepca Russelstein reepca@russelstein.xyz 2026-06-21T12:14:01+00:00 694785dc13840f36e9dda2fd413f0d6ac176f153 * nix/libutil/hash.hh (isHash32): new function. * nix/libutil/hash.hh (isHash32): provide implementation. Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
* nix/libutil/hash.hh (isHash32): new function.
* nix/libutil/hash.hh (isHash32): provide implementation.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: libutil: add base32Values and use them. 2026-06-24T13:20:16+00:00 Reepca Russelstein reepca@russelstein.xyz 2026-06-21T12:13:16+00:00 64a0824955aa40ea8e59bd4328ecaaf8caaa2acc Recognizing base32 characters and/or parsing them into byte sequences is done in several places, so it makes sense to provide a common lookup table. * nix/libutil/hash.hh (base32Values, base32ValuesInitialized): new variables. (initializeBase32Values, getBase32Value): new functions. * nix/libutil/hash.cc (base32Values, base32ValuesInitialized): provide definition for variables. (initializeBase32Values, getBase32Value): provide function implementations. (parseHash32): use base32Values. * nix/libstore/references.cc (search): use base32Values. Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
Recognizing base32 characters and/or parsing them into byte sequences is done
in several places, so it makes sense to provide a common lookup table.

* nix/libutil/hash.hh (base32Values, base32ValuesInitialized): new variables.
  (initializeBase32Values, getBase32Value): new functions.
* nix/libutil/hash.cc (base32Values, base32ValuesInitialized): provide
  definition for variables.
  (initializeBase32Values, getBase32Value): provide function implementations.
  (parseHash32): use base32Values.
* nix/libstore/references.cc (search): use base32Values.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: Actually remove unreadable directories. 2026-02-27T22:54:00+00:00 Reepca Russelstein reepca@russelstein.xyz 2026-02-15T18:39:34+00:00 865cb0188c282726008c56319a853c7dd82c4057 Fixes a regression introduced in 7173c2c0ca. Additional discussion at https://codeberg.org/guix/guix/pulls/5977. * nix/libutil/util.cc (_deletePathAt): chmod directory and retry open when it fails with EACCES. Do this using an O_PATH file descriptor referenced via /proc/self/fd whenever possible to avoid it being replaced by a non-directory immediately before being chmod'ed. * nix/libutil/util.hh (deletePath): document TOCTTOU race on non-linux systems where hardlinks aren't protected. * tests/derivations.scm ("unreadable directories in build tree can be removed"): new test. Fixes: guix/guix#5891 Reported-by: Liliana Marie Prikler <liliana.prikler@gmail.com> Change-Id: I749127fe5254ebabc8387a2f0ef47e3c116bfcc5 Signed-off-by: Ludovic Courtès <ludo@gnu.org> Merges: #6460 
Fixes a regression introduced in 7173c2c0ca.  Additional discussion at
https://codeberg.org/guix/guix/pulls/5977.

* nix/libutil/util.cc (_deletePathAt): chmod directory and retry open when it
  fails with EACCES.  Do this using an O_PATH file descriptor referenced via
  /proc/self/fd whenever possible to avoid it being replaced by a
  non-directory immediately before being chmod'ed.
* nix/libutil/util.hh (deletePath): document TOCTTOU race on non-linux systems
  where hardlinks aren't protected.
* tests/derivations.scm ("unreadable directories in build tree can be
  removed"): new test.

Fixes: guix/guix#5891
Reported-by: Liliana Marie Prikler <liliana.prikler@gmail.com>
Change-Id: I749127fe5254ebabc8387a2f0ef47e3c116bfcc5
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #6460
Merge branch 'version-1.5.0' 2026-01-22T12:27:13+00:00 Rutherther rutherther@ditigal.xyz 2026-01-22T12:27:13+00:00 7c0cd7e45b0240b842b4f3e767599501eac42ee1 Change-Id: Id73c0c74600a3da3373b3a37236b505af65bfe31 
Change-Id: Id73c0c74600a3da3373b3a37236b505af65bfe31
nix: Spelling corrections. 2026-01-14T08:16:45+00:00 Efraim Flashner efraim@flashner.co.il 2026-01-08T11:55:34+00:00 9efc2a690e5b5ea891457e2ae170597a548a19e6 * nix/libstore/globals.hh, nix/libstore/store-api.hh, nix/libutil/util.hh: Fix misspellings in comments. Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8 
* nix/libstore/globals.hh,
nix/libstore/store-api.hh,
nix/libutil/util.hh: Fix misspellings in comments.

Change-Id: Id77ea2bde1c2582d1a7bec4ed256ea900998c4b8
daemon: Fix several format strings. 2026-01-12T09:56:37+00:00 Ludovic Courtès ludo@gnu.org 2026-01-12T08:15:03+00:00 5ff038473e3f3d6a84e69c712446ba3e200aa9b2 This is a followup to 3af52f845fe2ceb448416ac7b9f48925673c594e and 6f1448ef89c8ad29e2a479099531fd3a87701e46. * nix/libstore/local-store.cc (LocalStore::queryValidPathId): Change %1% to {}. * nix/libstore/optimise-store.cc (LocalStore::optimisePath_): Likewise. * nix/nix-daemon/guix-daemon.cc (open_unix_domain_socket): Likewise. (main): Likewise. * nix/libutil/affinity.cc (restoreAffinity): Remove useless %1%. Change-Id: I3a7cd79cd69ab58f14118662f1dcf2fef067a6b7 
This is a followup to 3af52f845fe2ceb448416ac7b9f48925673c594e and
6f1448ef89c8ad29e2a479099531fd3a87701e46.

* nix/libstore/local-store.cc (LocalStore::queryValidPathId): Change %1% to {}.
* nix/libstore/optimise-store.cc (LocalStore::optimisePath_): Likewise.
* nix/nix-daemon/guix-daemon.cc (open_unix_domain_socket): Likewise.
(main): Likewise.
* nix/libutil/affinity.cc (restoreAffinity): Remove useless %1%.

Change-Id: I3a7cd79cd69ab58f14118662f1dcf2fef067a6b7
daemon: Use inline functions and variables instead of extern 2025-11-12T17:34:06+00:00 Congcong Kuo congcong.kuo@gmail.com 2025-10-20T03:39:00+00:00 d1a9fb85a4d46722f06d01bde6f61acae3d9ea7a Avoid separate declarations and definitions for so-called 'global' objects. * nix/libstore/derivations.{cc, hh} (drvHashes): Use inline instead of separate declaration and definition. * nix/libstore/globals.{cc, hh} (settings, nixVersion): Same. * nix/libstore/local-store.hh (drvsLogDir, deduplicationMinSize): Same. * nix/libstore/optimise-store.cc (deduplicationMinSize): Same. * nix/libstore/store-api.{cc, hh} (store): Same. * nix/libutil/archive.{cc, hh} (defaultPathFilter): Same. * nix/libutil/hash.{cc, hh} (base32Chars): Same and modify header files. * nix/libutil/util.{cc, hh} (logType, verbosity, _writeToStderr, _isInterrupted): Same. * nix/local.mk: Modified according to the rename of shared.hh. * nix/nix-daemon/guix-daemon.cc (blockInt, argvSaved, run): Same and modify header files. * nix/nix-daemon/nix-daemon.cc: Modify header files. * nix/nix-daemon/shared.hh: Renamed to nix-daemon.hh Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
Avoid separate declarations and definitions for so-called 'global' objects.

* nix/libstore/derivations.{cc, hh} (drvHashes): Use inline instead of separate
declaration and definition.
* nix/libstore/globals.{cc, hh} (settings, nixVersion): Same.
* nix/libstore/local-store.hh (drvsLogDir, deduplicationMinSize): Same.
* nix/libstore/optimise-store.cc (deduplicationMinSize): Same.
* nix/libstore/store-api.{cc, hh} (store): Same.
* nix/libutil/archive.{cc, hh} (defaultPathFilter): Same.
* nix/libutil/hash.{cc, hh} (base32Chars): Same and modify header files.
* nix/libutil/util.{cc, hh} (logType, verbosity, _writeToStderr,
_isInterrupted): Same.
* nix/local.mk: Modified according to the rename of shared.hh.
* nix/nix-daemon/guix-daemon.cc (blockInt, argvSaved, run): Same and
modify header files.
* nix/nix-daemon/nix-daemon.cc: Modify header files.
* nix/nix-daemon/shared.hh: Renamed to nix-daemon.hh

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: Use starts_with() and ends_with() instead of string() or hasSuffix() 2025-11-03T16:18:37+00:00 Congcong Kuo congcong.kuo@gmail.com 2025-10-20T07:47:25+00:00 85a72ed28e91f7f918a439c8678254537a374ac7 * nix/libstore/build.cc (DerivationGoal::tryBuildHook): Use starts_with instead of string() * nix/libstore/builtins.cc (lookupBuiltinBuilder): Same. * nix/libstore/builtins.hh (isBuiltin): Same and fix indentation of the file. * nix/libstore/derivations.cc (DerivationOutput::parseHashInfo, isDerivation): Same and clean header files. * nix/libstore/gc.cc (addPermRoot, LocalStore::isActiveTempFile): Same. * nix/libstore/globals.cc: Same. * nix/libstore/local-store.cc: Same. * nix/libstore/misc.cc: Same. * nix/libstore/store-api.cc (checkStoreName): Same. * nix/libutil/affinity.cc: Same. * nix/libutil/archive.cc: Same. * nix/libutil/spawn.cc: Same. * nix/libutil/util.{cc, hh} (hasSuffix): Removed. Signed-off-by: Ludovic Courtès <ludo@gnu.org> 
* nix/libstore/build.cc (DerivationGoal::tryBuildHook): Use starts_with instead
of string()
* nix/libstore/builtins.cc (lookupBuiltinBuilder): Same.
* nix/libstore/builtins.hh (isBuiltin): Same and fix indentation of the file.
* nix/libstore/derivations.cc (DerivationOutput::parseHashInfo, isDerivation):
Same and clean header files.
* nix/libstore/gc.cc (addPermRoot, LocalStore::isActiveTempFile): Same.
* nix/libstore/globals.cc: Same.
* nix/libstore/local-store.cc: Same.
* nix/libstore/misc.cc: Same.
* nix/libstore/store-api.cc (checkStoreName): Same.
* nix/libutil/affinity.cc: Same.
* nix/libutil/archive.cc: Same.
* nix/libutil/spawn.cc: Same.
* nix/libutil/util.{cc, hh} (hasSuffix): Removed.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>