Re: Signed archives

[Ludovic Courtès]

Nikita Karetnikov <address@hidden> skribis:

>>> Also, where can I find the corresponding NAR info file?  According to
>>> this commit [1], the signature should be there.
>
>> The .narinfo files are created on the fly.  When looking for a binary
>> for /nix/store/x4mnd9747fgwacjrvl1rynh59qlgz8gh-coreutils-8.21, the
>> substituter attempts to fetch:
>
>>   http://hydra.gnu.org/x4mnd9747fgwacjrvl1rynh59qlgz8gh.narinfo
>
>> It caches the answer (positive or negative) under
>> /nix/var/nix/substitute-binary/cache/x4mnd9747fgwacjrvl1rynh59qlgz8gh
>> (or similar.)
>
> Does Hydra create the .narinfo files?

Yes, as shown above.  :-)

(See NARInfo.pm in Hydra.)

> How can I create a signed .narinfo file locally (for testing
> purposes)?

You could copy one from /nix/var/nix/substitute-binary/cache or from a
URL like above.

To get the signature sexp, you can run ‘guix authenticate rsautl -sign
...’ (see tests/guix-authenticate.sh for an example.)  Then you’ll have
to base64-encode it somehow.

HTH,
Ludo’.