scripts: substitute: restored nars only appear after verification.

The hash of a nar is only known once 'download-nar' completes.  By that point
the nar may already have been partially-restored to its destination for some
time.  Additionally, after a hash mismatch is detected, 'guix substitute'
leaves the invalid contents at the specified destination.  This means that
untrusted, attacker-controlled contents are present at what at some point may
have been or at some point may become a valid store path.  It is entirely
possible that a user or program won't check that a given store item is valid
before trying to use it (it may be that 'guix gc' was run while an obscured
reference was held).  Let's protect them in that case by ensuring that
unverified contents are kept elsewhere, in a temporary directory.

While implementing this one such program was discovered: tests/substitute.scm.
It actually incorrectly computes the hashes of the nars it supplies to (guix
scripts substitute), computing the hash of the plain contents instead of the
hash of the nar.  These tests nevertheless passed because they didn't check
what (guix scripts substitute) gave as output, instead only checking that the
expected contents were at the specified destination.

* guix/scripts/substitute.scm (call-with-temporary-directory-in): new
  procedure.
  (guix-substitute): use it to create a temporary directory next to the final
  destination to restore the nar inside of.  Once it is fully restored, if the
  hash matches, move it to the final destination, deleting the file currently
  there if it already exists.
* tests/substitute.scm (plain-file-nar-sha256): new procedure.
  (%narinfo, "substitute, narinfo with several URLS" test): use it.

Change-Id: Ifeb9b4c912f9d9b2e7477d237da04e7d5175ff83
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

0 files changed, 0 insertions, 0 deletions