daemon: Bypass authentication when importing content-addressed store items.

This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8979

1 files changed, 10 insertions, 2 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index c5fed97da08..e7f1826542d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -5674,7 +5674,11 @@ references, corresponding derivation, and a digital signature.
 When exporting, the daemon digitally signs the contents of the archive,
 and that digital signature is appended.  When importing, the daemon
 verifies the signature and rejects the import in case of an invalid
-signature or if the signing key is not authorized.
+signature or if the signing key is not authorized; as an exception,
+store items that are @dfn{content-addressed}---source files and
+@file{.drv} files (@pxref{Derivations})---can be imported even if they
+lack an authorized signature because adding these to the store is not
+creating any new risk.
 @c FIXME: Add xref to daemon doc about signatures.
 
 The main options are:
@@ -5724,6 +5728,7 @@ Alternatively, @var{parameters} can specify
 public-key related Functions, @code{gcry_pk_genkey},, gcrypt, The
 Libgcrypt Reference Manual}).
 
+@anchor{archive-authorization}
 @item --authorize
 @cindex authorizing, archives
 Authorize imports signed by the public key passed on standard input.
@@ -51032,12 +51037,15 @@ with an @code{environment} of @code{managed-host-environment-type}.
 @item @code{host-name}
 @item @code{build-locally?} (default: @code{#t})
 If false, system derivations will be built on the machine being deployed to.
+As a bonus, when false, one does not need the target machine to have the
+key of the deployment machine among its authorized keys and thus the
+@code{authorize?} field below can remain @code{#f}.
 @item @code{system}
 The system type describing the architecture of the machine being deployed
 to---e.g., @code{"x86_64-linux"}.
 @item @code{authorize?} (default: @code{#t})
 If true, the coordinator's signing key will be added to the remote's ACL
-keyring.
+keyring (@pxref{archive-authorization, authorizing imports}).
 @item @code{port} (default: @code{22})
 @item @code{user} (default: @code{"root"})
 @item @code{identity} (default: @code{#f})