daemon: Bypass authentication when importing content-addressed store items.

This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8979

5 files changed, 70 insertions, 14 deletions

diff --git a/nix/libstore/local-store.cc b/nix/libstore/local-store.cc
index 6b5c388efc9..c38dd2072d4 100644
--- a/nix/libstore/local-store.cc
+++ b/nix/libstore/local-store.cc
@@ -1336,6 +1336,8 @@ Path LocalStore::importPath(Source & source)
 
     restorePath(unpacked, hashAndReadSource);
 
+    Hash narHash = hashAndReadSource.hashSink.currentHash().first;
+
     unsigned int magic = readInt(hashAndReadSource);
     if (magic != EXPORT_MAGIC)
         throw Error("normalized archive cannot be imported; wrong format");
@@ -1355,21 +1357,36 @@ Path LocalStore::importPath(Source & source)
     hashAndReadSource.hashing = false;
 
     bool haveSignature = readInt(hashAndReadSource) == 1;
+    string signature;
+    if (haveSignature)
+        signature = readString(hashAndReadSource);
 
-    if (!haveSignature)
-        throw Error(std::format("imported archive of `{}' lacks a signature", dstPath));
-
-    string signature = readString(hashAndReadSource);
-    string hash2 = verifySignature(signature);
-
-    /* Note: runProgram() throws an exception if the signature
-       is invalid. */
-
-    if (printHash(hash) != hash2)
-        throw Error(
-            "signed hash doesn't match actual contents of imported "
-            "archive; archive could be corrupt, or someone is trying "
-            "to import a Trojan horse");
+    try {
+        /* First, check whether there is a valid, authorized, matching
+           signature.  */
+        if (haveSignature) {
+            string hash2 = verifySignature(signature);
+            if (printHash(hash) != hash2)
+                throw AuthenticationError(
+                    "signed hash doesn't match actual contents of imported "
+                    "archive; archive could be corrupt, or someone is trying "
+                    "to import a Trojan horse");
+        }
+        else
+            throw AuthenticationError(std::format("imported archive of `{}' lacks a signature", dstPath));
+    }
+    catch (AuthenticationError &e) {
+        /* Second, check whether 'dstPath' is content-addressed--e.g., a store
+           item created by 'addToStore' or 'addTextToStore'.  XXX: This can
+           yield an extra 'hashFile' call and is limited to SHA256.  */
+        if (!(deriver == ""
+              && (isContentAddressedPath(dstPath, narHash, references, true)
+                  || (isPlainFile(unpacked)
+                      && isContentAddressedPath(dstPath, hashFile(htSHA256, unpacked),
+                                                references, false)))))
+            /* Rethrow. */
+            throw;
+    }
 
     /* Do the actual import. */
 
diff --git a/nix/libstore/store-api.cc b/nix/libstore/store-api.cc
index feabc821678..43f46176b5e 100644
--- a/nix/libstore/store-api.cc
+++ b/nix/libstore/store-api.cc
@@ -258,6 +258,29 @@ Path computeStorePathForText(const string & name, const string & s,
     return makeStorePath(type, hash, name);
 }
 
+bool isContentAddressedPath(const Path & path, const Hash & hash,
+                            const PathSet & references, bool recursive)
+{
+    /* Check whether PATH corresponds to something introduced by 'addToStore'
+       or by 'addTextToStore'.  For simplicity, anything with a hash other
+       than SHA256 is omitted: this returns false even though they are
+       content-addressed as well.  */
+    string name = storePathToName(path);
+    if (recursive) {
+      /* HASH is interpreted as the nar hash.  This can only come from
+         'addToStore'.  */
+      return references.empty() &&
+        path == makeFixedOutputPath(true, htSHA256, hash, name);
+    } else {
+      /* HASH is interpreted as the content hash.  This can come from
+         'addTextToStore' ("text" type, possibly with references) or from
+         'addToStore' ("output:out" type).  */
+      string type = textTypeWithReferences(references);
+      return path == makeStorePath(type, hash, name)
+        || (references.empty() &&
+            path == makeFixedOutputPath(false, htSHA256, hash, name));
+    }
+}
 
 /* Return a string accepted by decodeValidPathInfo() that
    registers the specified paths as valid.  Note: it's the
diff --git a/nix/libstore/store-api.hh b/nix/libstore/store-api.hh
index 29b33c0be9c..398ccd260ea 100644
--- a/nix/libstore/store-api.hh
+++ b/nix/libstore/store-api.hh
@@ -362,6 +362,12 @@ Path makeFixedOutputPath(bool recursive,
 Path computeStorePathForText(const string & name, const string & s,
     const PathSet & references);
 
+/* Return true if PATH, whose content has the given HASH, refers to a
+   content-addressed file as added by 'addTextToStore' or 'addToStore'.  HASH
+   is interpreted as a SHA256 nar hash when RECURSIVE is true, and as a SHA256
+   file content hash when RECURSIVE is false.  */
+bool isContentAddressedPath(const Path & path, const Hash & hash,
+    const PathSet & references, bool recursive);
 
 /* Remove the temporary roots file for this process.  Any temporary
    root becomes garbage after this point unless it has been registered
diff --git a/nix/libutil/util.cc b/nix/libutil/util.cc
index 95f293ff10f..72c8d38bd50 100644
--- a/nix/libutil/util.cc
+++ b/nix/libutil/util.cc
@@ -287,6 +287,13 @@ unsigned char getFileType(const Path & path)
     return DT_UNKNOWN;
 }
 
+bool isPlainFile(const Path & path)
+{
+    struct stat st = lstat(path);
+    return S_ISREG(st.st_mode)
+      && ((st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0);
+}
+
 
 string readFile(int fd)
 {
diff --git a/nix/libutil/util.hh b/nix/libutil/util.hh
index 44d579f3d6a..ee8e5461b42 100644
--- a/nix/libutil/util.hh
+++ b/nix/libutil/util.hh
@@ -65,6 +65,9 @@ Path readLink(const Path & path);
 
 bool isLink(const Path & path);
 
+/* Return true if the file at PATH is a regular, non-executable file.  */
+bool isPlainFile(const Path & path);
+
 /* Read the contents of a directory.  The entries `.' and `..' are
    removed. */
 struct DirEntry