Re: Signed archive export/import

[Ludovic Courtès]

address@hidden (Ludovic Courtès) skribis:

>   - a ‘guix archive’ command to easily import/export archives, and to
>     generate a key pair;

Done in commit 760c60d; see the doc below.

Ludo’.


3.6 Invoking ‘guix archive’
===========================

The ‘guix archive’ command allows users to "export" files from the store
into a single archive, and to later "import" them.  In particular, it
allows store files to be transferred from one machine to another
machine’s store.  For example, to transfer the ‘emacs’ package to a
machine connected over SSH, one would run:

     guix archive --export emacs | ssh the-machine guix archive --import

   Archives are stored in the “Nix archive” or “Nar” format, which is
comparable in spirit to ‘tar’.  When exporting, the daemon digitally
signs the contents of the archive, and that digital signature is
appended.  When importing, the daemon verifies the signature and rejects
the import in case of an invalid signature.

   The main options are:

‘--export’
     Export the specified store files or packages (see below.)  Write
     the resulting archive to the standard output.

‘--import’
     Read an archive from the standard input, and import the files
     listed therein into the store.  Abort if the archive has an invalid
     digital signature.

   To export store files as an archive to the standard output, run:

     guix archive --export OPTIONS SPECIFICATIONS...

   SPECIFICATIONS may be either store file names or package
specifications, as for ‘guix package’ (*note Invoking guix package::).
For instance, the following command creates an archive containing the
‘gui’ output of the ‘git’ package and the main output of ‘emacs’:

     guix archive --export git:gui /nix/store/...-emacs-24.3 > great.nar

   If the specified packages are not built yet, ‘guix archive’
automatically builds them.  The build process may be controlled with the
same options that can be passed to the ‘guix build’ command (*note
Invoking guix build::).