daemon: Bypass authentication when importing content-addressed store items.

This puts ‘importPaths’ on par with ‘addToStore’ and ‘addTextToStore’: since
the two latter RPCs let anyone add content-addressed items in the store,
there’s no reason for ‘importPaths’ to require signatures by authorized keys
on these content-addressed items.

This will allow for things like ‘guix copy’ of .drv items without
authorization, or ‘guix deploy’ with (build-locally? #f) without
authorization.

* nix/libstore/store-api.hh (isContentAddressedPath): New prototype.
* nix/libstore/store-api.cc (isContentAddressedPath): New function.
* nix/libutil/util.hh (isPlainFile): New prototype.
* nix/libutil/util.cc (isPlainFile): New function.
* nix/libstore/local-store.cc (LocalStore::importPath): Define ‘narHash’ and
‘contentAddressed’.  Allow unsigned imports when ‘contentAddressed’ is true;
bypass signature verification when ‘contentAddressed’ is true.
* tests/store.scm ("import not signed"): Rewrite to not use a
content-addressed store item.
("import signed by unauthorized key"): Likewise.
("import not signed but content-addressed tree"): New test.
("import not signed but content-addressed regular file"): New test.
("import signed by unauthorized key but content-addressed"): New test.
("import with corrupt signature"): New test.
("import signed by authorized key but hash doesn't match"): New test.
("import with corrupt signature but content-addressed"): New test.
("import signed by authorized key, hash doesn't match, but content-addressed"):
New test.
* doc/guix.texi (Invoking guix archive): Document the exception for
content-addressed store items.  Add anchor for ‘--authorize’.
(Invoking guix deploy): Document the benefit of (build-locally? #f).
Add cross-reference for ‘authorize?’.

Co-authored-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #8979

1 files changed, 280 insertions, 15 deletions

diff --git a/tests/store.scm b/tests/store.scm
index e7ba7469047..ba634ce2205 100644
--- a/tests/store.scm
+++ b/tests/store.scm
@@ -30,7 +30,8 @@
   #:use-module (guix derivations)
   #:use-module ((guix modules)
                 #:select (source-module-closure))
-  #:use-module (guix serialization)
+  #:use-module ((guix serialization)
+                #:hide (store-path read-string))
   #:use-module (guix build utils)
   #:use-module ((gnu build linux-container)
                 #:select (unprivileged-user-namespace-supported?))
@@ -1456,18 +1457,25 @@ System: x86_64-linux~%"
 
 
 (test-assert "import not signed"
-  (let* ((text (random-text))
-         (file (add-file-tree-to-store %store
-                                       `("tree" directory
-                                         ("text" regular (data ,text))
-                                         ("link" symlink "text"))))
+  (let* ((content (random-text))
+         (name "fake-derivation")
+         (store-item (output-path "out"
+                                  (gcrypt:sha256 #vu8())
+                                  name))
          (dump (call-with-bytevector-output-port
                 (lambda (port)
                   (write-int 1 port)              ;start
 
-                  (write-file file port)          ;contents
+                  (write-file-tree name port      ;contents
+                                   #:file-type+size
+                                   (lambda (_)
+                                     (values 'regular
+                                             (string-length content)))
+                                   #:file-port
+                                   (lambda (_)
+                                     (open-input-string content)))
                   (write-int #x4558494e port)     ;%export-magic
-                  (write-string file port)        ;store item
+                  (write-string store-item port)  ;store item
                   (write-string-list '() port)    ;references
                   (write-string "" port)          ;deriver
                   (write-int 0 port)              ;not signed
@@ -1485,11 +1493,11 @@ System: x86_64-linux~%"
         #f))))
 
 (test-assert "import signed by unauthorized key"
-  (let* ((text (random-text))
-         (file (add-file-tree-to-store %store
-                                       `("tree" directory
-                                         ("text" regular (data ,text))
-                                         ("link" symlink "text"))))
+  (let* ((content (random-text))
+         (name "fake-derivation")
+         (store-item (output-path "out"
+                                  (gcrypt:sha256 #vu8())
+                                  name))
          (key  (gcrypt:generate-key
                 (gcrypt:string->canonical-sexp
                  "(genkey (ecdsa (curve Ed25519) (flags rfc6979)))")))
@@ -1497,9 +1505,16 @@ System: x86_64-linux~%"
                 (lambda (port)
                   (write-int 1 port)              ;start
 
-                  (write-file file port)          ;contents
+                  (write-file-tree name port      ;contents
+                                   #:file-type+size
+                                   (lambda (_)
+                                     (values 'regular
+                                             (string-length content)))
+                                   #:file-port
+                                   (lambda (_)
+                                     (open-input-string content)))
                   (write-int #x4558494e port)     ;%export-magic
-                  (write-string file port)        ;store item
+                  (write-string store-item port)  ;store item
                   (write-string-list '() port)    ;references
                   (write-string "" port)          ;deriver
                   (write-int 1 port)              ;signed
@@ -1524,6 +1539,256 @@ System: x86_64-linux~%"
         (pk 'unauthorized-imported imported)
         #f))))
 
+(test-assert "import with corrupt signature"
+  (let* ((content (random-text))
+         (name "fake-derivation")
+         (store-item (output-path "out"
+                                  (gcrypt:sha256 #vu8())
+                                  name))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file-tree name port      ;contents
+                                   #:file-type+size
+                                   (lambda (_)
+                                     (values 'regular
+                                             (string-length content)))
+                                   #:file-port
+                                   (lambda (_)
+                                     (open-input-string content)))
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string store-item port)  ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 1 port)              ;signed
+                  (write-string (object->string '(signature broken))
+                                port)
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' raises an exception.
+    (guard (c ((store-protocol-error? c)
+               (and (not (zero? (store-protocol-error-status c)))
+                    (string-contains (store-protocol-error-message c)
+                                     "corrupt signature"))))
+      (let* ((source   (open-bytevector-input-port dump))
+             (imported (import-paths %store source)))
+        (pk 'corrupt-signature-imported imported)
+        #f))))
+
+(test-assert "import signed by authorized key but hash doesn't match"
+  (let* ((content (random-text))
+         (name "fake-derivation")
+         (store-item (output-path "out"
+                                  (gcrypt:sha256 #vu8())
+                                  name))
+         ;; This key is known to be in the ACL by default.
+         (public-key
+           (call-with-input-file (string-append %config-directory "/signing-key.pub")
+             (compose gcrypt:string->canonical-sexp get-string-all)))
+         (private-key
+           (call-with-input-file (string-append %config-directory "/signing-key.sec")
+             (compose gcrypt:string->canonical-sexp get-string-all)))
+
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file-tree name port      ;contents
+                                   #:file-type+size
+                                   (lambda (_)
+                                     (values 'regular
+                                             (string-length content)))
+                                   #:file-port
+                                   (lambda (_)
+                                     (open-input-string content)))
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string store-item port)  ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 1 port)              ;signed
+                  (write-string (gcrypt:canonical-sexp->string
+                                 (signature-sexp
+                                  (gcrypt:bytevector->hash-data
+                                   (gcrypt:sha256 #vu8(0 1 2))
+                                   #:key-type 'rsa)
+                                  private-key
+                                  public-key))
+                                port)
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' raises an exception.
+    (guard (c ((store-protocol-error? c)
+               (and (not (zero? (store-protocol-error-status c)))
+                    (string-contains (store-protocol-error-message c)
+                                     "hash doesn't match"))))
+      (let* ((source   (open-bytevector-input-port dump))
+             (imported (import-paths %store source)))
+        (pk 'hash-mismatch-imported imported)
+        #f))))
+
+(test-assert "import not signed but content-addressed tree"
+  (let* ((text (random-text))
+         (file (add-file-tree-to-store %store
+                                       `("tree" directory
+                                         ("text" regular (data ,text))
+                                         ("link" symlink "text"))))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file file port)          ;contents
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string file port)        ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 0 port)              ;not signed
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' completes despite the lack of signature.
+    (let ((source (open-bytevector-input-port dump)))
+      (match (import-paths %store source)
+        ((imported)
+         (string=? (pk 'imported imported) file))))))
+
+(test-assert "import not signed but content-addressed regular file"
+  (let* ((name "content-addressed")
+         (content (random-text))
+         (store-item (store-path "text"
+                                 (gcrypt:sha256 (string->utf8 content))
+                                 name))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)           ;start
+                  (write-file-tree name port   ;contents
+                                   #:file-type+size
+                                   (lambda (_)
+                                     (values 'regular
+                                             (string-length content)))
+                                   #:file-port
+                                   (lambda (_)
+                                     (open-input-string content)))
+                  (write-int #x4558494e port)  ;%export-magic
+                  (write-string store-item port)
+                  (write-string-list '() port) ;references
+                  (write-string "" port)       ;deriver
+                  (write-int 0 port)           ;not signed
+                  (write-int 0 port)))))       ;done
+
+    ;; Ensure 'import-paths' completes despite the lack of signature.
+    (let ((source (open-bytevector-input-port dump)))
+      (match (import-paths %store source)
+        ((imported)
+         (and (string=? (pk 'imported imported) store-item)
+              (string=? (call-with-input-file imported get-string-all)
+                        content)))))))
+
+(test-assert "import signed by unauthorized key but content-addressed"
+  (let* ((text (random-text))
+         (file (add-file-tree-to-store %store
+                                       `("tree" directory
+                                         ("text" regular (data ,text))
+                                         ("link" symlink "text"))))
+         (key  (gcrypt:generate-key
+                (gcrypt:string->canonical-sexp
+                 "(genkey (ecdsa (curve Ed25519) (flags rfc6979)))")))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file file port)          ;contents
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string file port)        ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 1 port)              ;signed
+                  (write-string (gcrypt:canonical-sexp->string
+                                 (signature-sexp
+                                  (gcrypt:bytevector->hash-data
+                                   (gcrypt:sha256 #vu8(0 1 2))
+                                   #:key-type 'ecc)
+                                  (gcrypt:find-sexp-token key 'private-key)
+                                  (gcrypt:find-sexp-token key 'public-key)))
+                                port)
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' succeeds despite the unauthorized signature.
+    (let ((source (open-bytevector-input-port dump)))
+      (match (import-paths %store source)
+        ((imported)
+         (string=? imported file))))))
+
+(test-assert "import with corrupt signature but content-addressed"
+  (let* ((text (random-text))
+         (file (add-file-tree-to-store %store
+                                       `("tree" directory
+                                         ("text" regular (data ,text))
+                                         ("link" symlink "text"))))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file file port)          ;contents
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string file port)        ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 1 port)              ;signed
+                  (write-string (object->string '(signature broken))
+                                port)
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' succeeds despite the corrupt signature.
+    (let ((source (open-bytevector-input-port dump)))
+      (match (import-paths %store source)
+        ((imported)
+         (string=? imported file))))))
+
+(test-assert "import signed by authorized key, hash doesn't match, but content-addressed"
+  (let* ((text (random-text))
+         (file (add-file-tree-to-store %store
+                                       `("tree" directory
+                                         ("text" regular (data ,text))
+                                         ("link" symlink "text"))))
+         ;; This key is known to be in the ACL by default.
+         (public-key
+           (call-with-input-file (string-append %config-directory "/signing-key.pub")
+             (compose gcrypt:string->canonical-sexp get-string-all)))
+         (private-key
+           (call-with-input-file (string-append %config-directory "/signing-key.sec")
+             (compose gcrypt:string->canonical-sexp get-string-all)))
+         (dump (call-with-bytevector-output-port
+                (lambda (port)
+                  (write-int 1 port)              ;start
+
+                  (write-file file port)          ;contents
+                  (write-int #x4558494e port)     ;%export-magic
+                  (write-string file port)        ;store item
+                  (write-string-list '() port)    ;references
+                  (write-string "" port)          ;deriver
+                  (write-int 1 port)              ;signed
+                  (write-string (gcrypt:canonical-sexp->string
+                                 (signature-sexp
+                                  (gcrypt:bytevector->hash-data
+                                   (gcrypt:sha256 #vu8(0 1 2))
+                                   #:key-type 'rsa)
+                                  private-key
+                                  public-key))
+                                port)
+
+                  (write-int 0 port)))))          ;done
+
+    ;; Ensure 'import-paths' succeeds despite the hash mismatch.
+    (let ((source (open-bytevector-input-port dump)))
+      (match (import-paths %store source)
+        ((imported)
+         (string=? imported file))))))
+
 (test-assert "import corrupt path"
   (let* ((text (random-text))
          (file (add-text-to-store %store "text" text))