guix/tests/store.scm, branch master

daemon: Bypass authentication when importing content-addressed store items.

2026-08-17T14:47:36+00:00

This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein 
Signed-off-by: Ludovic Courtès 
Merges: #8979

store: Add ‘valid-path-syntax?’ and ‘valid-store-name?’.

2026-07-02T17:42:47+00:00

* guix/store.scm (store-path?): Update docstring.
(%store-item-charset): New variable.
(valid-store-name?, valid-path-basename-syntax?, valid-path-syntax?): New
procedures.
* tests/store.scm ("valid-path-syntax?")
("valid-path-syntax? truncated hash")
("valid-path-syntax? slash")
("valid-path-syntax? leading dot")
("valid-path-syntax? prefix")
("valid-path-syntax? truncated"): New tests.

Change-Id: Ic808dd5a8270fbea20e9c99c2861f30133d13b41
Signed-off-by: Ludovic Courtès

daemon: Don't delete files from the store with guix build -K --rounds=3 --check.

2026-07-01T07:08:53+00:00

Specifying all three of -K, --check, --rounds=3 caused valid packages to be
deleted from the store.

When `buildMode == bmCheck`, the built package is not renamed from
`actualPath` to `i.second.path.  Then later, when `settings.keepFailed` and
`curRound < nrRounds`, `i.second.path` was renamed to `i.second.path + "-check"`
anyway.

* nix/libstore/build.cc (DerivationGoal::registerOutputs): Add check for bmCheck
before renaming store path.
* tests/store.scm ("build-things, check mode"): Ensure file is a valid path.
("build-things, check mode + keep-failed"): New test.

Fixes: #9631.
Change-Id: I31d24b2349f563867b8101a1b5ce3c10896ce165
Co-authored-by: Ludovic Courtès 
Signed-off-by: Ludovic Courtès 
Merges: #9632

daemon: libstore: reject invalid store paths in importPath.

2026-06-24T13:20:16+00:00

Previously an authorized substitute server could produce invalid store paths -
that is, paths that do denote a top-level file in the store, but that do not
obey the syntax restrictions beyond what that implies.  Given that an
authorized substitute server can already potentially do a lot of damage if it
really wanted to, this isn't a major issue, but closing off this opportunity
does simplify the analysis somewhat.

* nix/libstore/local-store.cc (LocalStore::importPath): use
  strict readStorePath(s) variants.
* tests/store.scm ("import path not in store, unsigned", "import path not in
  store, signed", "import invalid path, unsigned", "import invalid path,
  signed" test cases): new test cases.  The "not in store" cases succeeded
  previously, while the "invalid path" cases did not succeed prior to this
  commit.

Fixes: guix/guix#9078
Change-Id: Ib81c19ec1ae0fff5b7c7268f4f7429b16a870996
Signed-off-by: Ludovic Courtès 
Merges: #9434

store: Make derivation-path? use direct-store-path?.

2026-02-10T10:36:16+00:00

* guix/store.scm (derivation-path?): Use direct-store-path? instead of
store-path?.
* tests/store.scm (derivation-path?): New test.

Change-Id: Ib54b9e2045f19f26039cf072eeb79dab8f0195be
Signed-off-by: Ludovic Courtès 
Merges: #6192

tests: Adjust to Guile 3.0.10+.

2026-01-25T20:23:25+00:00

Guile 3.0.11 introduced a new implementation of (srfi srfi-34) with subtle
changes wrt. exceptionm handling.  This adjusts to these changes.

Changes in ‘tests/style.scm’ are due to the new output of (ice-9 pretty-print)
in 3.0.10.

* tests/file-systems.scm ("btrfs-store-subvolume-file-name (subvolid)"):
Specify the exception type.
* tests/services/file-sharing.scm ("transmission-password-hash, salt value too short")
("transmission-password-hash, salt value too long"): Likewise.
* tests/store.scm ("store-path-package-name #f"): Change to ‘test-error’
with #t as the exception type.
* tests/style.scm: Skip all the tests on Guile > 3.0.9.
* tests/toml.scm : Set ‘raise’ in (guix build toml).
("parse-toml: No key"): Use ‘test-error’ instead of ‘test-equal’.
("parse-toml: Assignment to non-table"): Likewise.
("parse-toml: Invalid assignment to implicit table"): Change exception type
to #t
("parse-toml: Assignment to statically defined array"): Likewise.

Change-Id: I54ea77f22d3e95f72dad90690631876e7f013054
Signed-off-by: Ludovic Courtès 
Signed-off-by: Rutherther

daemon: Attempt to map the “kvm” group inside the build user namespace.

2025-10-16T13:14:37+00:00

Fixes .

Previously, the ‘guix-daemon’ account (for unprivileged execution) would
typically have “kvm” as a supplementary group, but that group would not
be mapped in the build user namespace.  Consequently, attempts to
‘chown’ a file to that supplementary group would fail with EINVAL.

The test suites of Coreutils, Python, and Go (among others) exercise
this chown-to-supplementary-group behavior, so they would all fail when
started by the unprivileged ‘guix-daemon’ even though they succeed when
started by ‘guix-daemon’ running as root.

Thanks to keinflue  and Reepca Russelstein
 for helping out.

* nix/libstore/build.cc (initializeUserNamespace): Add ‘extraGIDs’ and
‘haveCapSetGID’ parameters.  Invoke ‘newgidmap’ when ‘extraGIDs’ is
non-empty and ‘haveCapSetGID’ is false.  Honor ‘extraGIDs’ when
‘haveCapSetGID’ is true.
(maxGroups, guestKVMGID): New variables.
(kvmGIDMapping): New function.
(DerivationGoal::startBuilder): Set ‘ctx.lockMountsMapAll’ in the
CLONE_NEWUSER case.  Pass ‘extraGIDs’ to ‘initializeUserNamespace’.
* tests/store.scm ("kvm GID is mapped"): New test.

Change-Id: I10ba710fc1b9ca1e3cd3122be1ec8ede5df18b40

daemon: Restore post-canonicalization permissions after moving.

2025-09-23T09:13:22+00:00

At this point the value of 'st.st_mode' is from before canonicalization, so
restoring to that will undo the permissions aspect of the canonicalization for
a top-level directory store item.

Fixes #1104, introduced in
ae18b3d9e6 (https://codeberg.org/guix/guix/commit/ae18b3d9e6bd0c184505a094851448d08555e23e).

* nix/libstore/build.cc (DerivationGoal::registerOutputs): update 'st' with
  post-canonicalization permissions before making actualPath
  temporarily-writable.
* tests/store.scm ("build outputs aren't writable"): new test.

Change-Id: I5e5eaa79fa6b7f81e1d12fd285883c762a22ce5a
Signed-off-by: Ludovic Courtès

daemon: Use the guest GID in /etc/group.

2025-04-25T18:25:54+00:00

Partly fixes .

Fixes a bug whereby, when running guix-daemon unprivileged, /etc/group
would contain the wrong GID for the “nixbld” group.  This inconsistency
would lead to failures in the Coreutils test suite, for instance.

* nix/libstore/build.cc (DerivationGoal::startBuilder): Use ‘guestGID’
when writing /etc/group.
* tests/store.scm ("/etc/passwd and /etc/group"): New test.

Reported-by: keinflue 
Change-Id: I739bc96c4c935fd9015a45e2bfe5b3e3f90554a9

daemon: Do not make chroot root directory read-only.

2025-04-11T10:18:01+00:00

Fixes .

Commit 40f69b586a440d0397fa3dfe03b95a0f44e4d242 made chroot root
directory read-only; as a consequence, build processes attempting to
write to the root directory would now get EROFS instead of EACCES.

It turns out that a number of test suites (Go, Ruby, SCons, Shepherd)
would fail because of this observable difference.

To restore previous behavior in build environments while still
preventing build processes from exposing their root directory to outside
processes, this patch (1) keeps the root writable but #o555 by default,
thereby restoring the EACCES behavior, and (2) ensures that the parent
of the chroot root directory is itself user-accessible only.

* nix/libstore/build.cc (class DerivationGoal)[chrootRootTop]: New
field.
(DerivationGoal::startBuilder): Initialize ‘chrootRootTop’ and make it
‘AutoDelete’.  Replace ‘mount’ call that made the root directory
read-only by a mere ‘chmod_’ call.
* tests/store.scm ("build root cannot be made world-readable"): Remove.
("writing to build root leads to EACCES"): New test.

Reported-by: Ada Stevenson 
Reported-by: keinflue 
Suggested-by: Reepca Russelstein 
Change-Id: I5912e8b3b293f8242a010cfc79255fc981314445