Previously, we'd spawn 'guix authenticate' once for each item that has
to be signed (when exporting) or authenticated (when importing). Now,
we spawn it once for all and then follow a request/reply protocol. This
reduces the wall-clock time of:
guix archive --export -r $(guix build coreutils -d)
* guix/scripts/authenticate.scm (sign-with-key): Return the signature
instead of displaying it. Raise a &formatted-message instead of calling
(validate-signature): Likewise.
(read-command): New procedure.
(guix-authenticate)[send-reply]: New procedure.
Change to read commands from current-input-port.
* nix/libstore/local-store.cc (runAuthenticationProgram): Remove.
(authenticationAgent, readInteger, readAuthenticateReply): New
(signHash, verifySignature): Rewrite in terms of the agent.
* tests/store.scm ("import not signed"): Remove 'pk' call.
("import signed by unauthorized key"): Check the error message of C.
* tests/guix-authenticate.sh: Rewrite using the new protocol.
guix/scripts/authenticate.scm | 119 ++++++++++++++++++++++++++--------
nix/libstore/local-store.cc | 86 +++++++++++++++++++-----
tests/guix-authenticate.sh | 45 +++++++------
4 files changed, 190 insertions(+), 68 deletions(-)
Toggle diff (388 lines)
diff --git a/guix/scripts/authenticate.scm b/guix/scripts/authenticate.scm
index fceac13a84..34737481d5 100644
--- a/guix/scripts/authenticate.scm
+++ b/guix/scripts/authenticate.scm
#:use-module (gcrypt pk-crypto)
+ #:use-module (guix diagnostics)
+ #:use-module (srfi srfi-34)
+ #:use-module (srfi srfi-35)
+ #:use-module (rnrs bytevectors)
#:use-module (ice-9 binary-ports)
#:use-module (ice-9 rdelim)
#:use-module (ice-9 match)
(compose string->canonical-sexp read-string))
(define (sign-with-key key-file sha256)
- "Sign the hash SHA256 (a bytevector) with KEY-FILE, and write an sexp that
-includes both the hash and the actual signature."
+ "Sign the hash SHA256 (a bytevector) with KEY-FILE, and return the signature
+as a canonical sexp that includes both the hash and the actual signature."
(let* ((secret-key (call-with-input-file key-file read-canonical-sexp))
(public-key (if (string-suffix? ".sec" key-file)
(string-append (string-drop-right key-file 4)
- (G_ "cannot find public key for secret key '~a'~%")
+ (G_ "cannot find public key for secret key '~a'~%")
(data (bytevector->hash-data sha256
#:key-type (key-type public-key)))
(signature (signature-sexp data secret-key public-key)))
- (display (canonical-sexp->string signature))
(define (validate-signature signature)
"Validate SIGNATURE, a canonical sexp. Check whether its public key is
-authorized, verify the signature, and print the signed data to stdout upon
+authorized, verify the signature, and return the signed data (a bytevector)
(let* ((subject (signature-subject signature))
(data (signature-signed-data signature)))
(if (authorized-key? subject)
(if (valid-signature? signature)
- (let ((hash (hash-data->bytevector data)))
- (display (bytevector->base16-string hash))
- (leave (G_ "error: invalid signature: ~a~%")
- (canonical-sexp->string signature)))
- (leave (G_ "error: unauthorized public key: ~a~%")
- (canonical-sexp->string subject)))
- (leave (G_ "error: corrupt signature data: ~a~%")
- (canonical-sexp->string signature)))))
+ (hash-data->bytevector data) ; success
+ (formatted-message (G_ "invalid signature: ~a")
+ (canonical-sexp->string signature))))
+ (formatted-message (G_ "unauthorized public key: ~a")
+ (canonical-sexp->string subject))))
+ (formatted-message (G_ "corrupt signature data: ~a")
+ (canonical-sexp->string signature))))))
+(define (read-command port)
+ "Read a command from PORT and return the command and arguments as a list of
+strings. Return the empty list when the end-of-file is reached.
+Commands are newline-terminated and must look something like this:
+ COMMAND 3:abc 5:abcde 1:x
+where COMMAND is an alphanumeric sequence and the remainder is the command
+arguments. Each argument is written as its length (in characters), followed
+by colon, followed by the given number of characters."
+ (define (consume-whitespace port)
+ (let ((chr (lookahead-u8 port)))
+ (when (eqv? chr (char->integer #\space))
+ (consume-whitespace port))))
+ (match (read-delimited " \t\n\r" port)
+ (let loop ((result (list command)))
+ (consume-whitespace port)
+ (let ((next (lookahead-u8 port)))
+ (cond ((eqv? next (char->integer #\newline))
+ (let* ((len (string->number (read-delimited ":" port)))
+ (get-bytevector-n port len))))
+ (loop (cons str result))))))))))
@@ -81,6 +121,13 @@ success."
(define (guix-authenticate . args)
+ (define (send-reply code str)
+ ;; Send CODE and STR as a reply to our client.
+ (let ((bv (string->utf8 str)))
+ (format #t "~a ~a:" code (bytevector-length bv))
+ (put-bytevector (current-output-port) bv)
+ (force-output (current-output-port))))
;; Signature sexps written to stdout may contain binary data, so force
;; ISO-8859-1 encoding so that things are not mangled. See
;; <http://bugs.gnu.org/17312> for details.
@@ -91,21 +138,37 @@ success."
(with-fluids ((%default-port-encoding "ISO-8859-1")
(%default-port-conversion-strategy 'error))
- (("sign" key-file hash)- (sign-with-key key-file (base16-string->bytevector hash)))
- (("verify" signature-file)- (call-with-input-file signature-file
- (validate-signature (string->canonical-sexp
- (read-string port))))))
(display (G_ "Usage: guix authenticate OPTION...
Sign or verify the signature on the given file. This tool is meant to
be used internally by 'guix-daemon'.\n")))
(show-version-and-exit "guix authenticate"))
- (leave (G_ "wrong arguments"))))))
+ (guard (c ((formatted-message? c)
+ (G_ (formatted-message-string c))
+ (formatted-message-arguments c)))))
+ ;; Read a request on standard input and reply.
+ (match (read-command (current-input-port))
+ (("sign" signing-key (= base16-string->bytevector hash))+ (let ((signature (sign-with-key signing-key hash)))
+ (send-reply 0 (canonical-sexp->string signature))))
+ (bytevector->base16-string
+ (string->canonical-sexp signature)))))
+ (warning (G_ "~s: invalid command; ignoring~%") commands)
+ (send-reply 404 "invalid command"))))
+ (leave (G_ "wrong arguments~%"))))))
;;; authenticate.scm ends here
diff --git a/nix/libstore/local-store.cc b/nix/libstore/local-store.cc
index cbbd8e901d..9bc7a0bc4f 100644
--- a/nix/libstore/local-store.cc
+++ b/nix/libstore/local-store.cc
@@ -1231,39 +1231,91 @@ static void checkSecrecy(const Path & path)
-static std::string runAuthenticationProgram(const Strings & args)
+/* Return the authentication agent, a "guix authenticate" process started
+static std::shared_ptr<Agent> authenticationAgent()
- Strings fullArgs = { "authenticate" };- fullArgs.insert(fullArgs.end(), args.begin(), args.end()); // append
- return runProgram(settings.guixProgram, false, fullArgs);
+ static std::shared_ptr<Agent> agent;
+ Strings args = { "authenticate" };+ agent = std::shared_ptr<Agent>(new Agent(settings.guixProgram, args));
+/* Read an integer and the byte that immediately follows it from FD. Return
+static int readInteger(int fd)
+ ssize_t rd = read(fd, &ch, 1);
+ throw SysError("reading an integer");+ throw EndOfFile("unexpected EOF reading an integer");+ if (strchr("0123456789", ch)) {+/* Read from FD a reply coming from 'guix authenticate'. The reply has the
+ form "CODE LEN:STR". CODE is an integer, where zero indicates success.
+ LEN specifies the length in bytes of the string that immediately
+static std::string readAuthenticateReply(int fd)
+ int code = readInteger(fd);
+ int len = readInteger(fd);
+ readFull(fd, (unsigned char *) &str[0], len);
/* Sign HASH with the key stored in file SECRETKEY. Return the signature as a
string, or raise an exception upon error. */
static std::string signHash(const string &secretKey, const Hash &hash)
- args.push_back("sign");- args.push_back(secretKey);
- args.push_back(printHash(hash));
+ auto agent = authenticationAgent();
+ auto hexHash = printHash(hash);
- return runAuthenticationProgram(args);
+ writeLine(agent->toAgent.writeSide,
+ (format("sign %1%:%2% %3%:%4%")+ % secretKey.size() % secretKey
+ % hexHash.size() % hexHash).str());
+ return readAuthenticateReply(agent->fromAgent.readSide);
/* Verify SIGNATURE and return the base16-encoded hash over which it was
static std::string verifySignature(const string &signature)
- Path tmpDir = createTempDir("", "guix", true, true, 0700);- AutoDelete delTmp(tmpDir);
+ auto agent = authenticationAgent();
- Path sigFile = tmpDir + "/sig";
- writeFile(sigFile, signature);
+ writeLine(agent->toAgent.writeSide,
+ (format("verify %1%:%2%")+ % signature.size() % signature).str());
- args.push_back("verify");- args.push_back(sigFile);
- return runAuthenticationProgram(args);
+ return readAuthenticateReply(agent->fromAgent.readSide);
void LocalStore::exportPath(const Path & path, bool sign,
diff --git a/tests/guix-authenticate.sh b/tests/guix-authenticate.sh
index 773443453d..f3b36ee41d 100644
--- a/tests/guix-authenticate.sh
+++ b/tests/guix-authenticate.sh
@@ -28,33 +28,38 @@ rm -f "$sig" "$hash"
trap 'rm -f "$sig" "$hash"' EXIT
+key="$abs_top_srcdir/tests/signing-key.sec"
+key_len="`echo -n $key | wc -c`"
# A hexadecimal string as long as a sha256 hash.
hash="2749f0ea9f26c6c7be746a9cff8fa4c2f2a02b000070dba78429e9a11f87c6eb"
+hash_len="`echo -n $hash | wc -c`"
-guix authenticate sign \
- "$abs_top_srcdir/tests/signing-key.sec" \
+echo "sign $key_len:$key $hash_len:$hash" | guix authenticate > "$sig"
+ *) echo "broken signature: $(cat $sig)"
-hash2="`guix authenticate verify "$sig"`"
+# Remove the leading "0".
+sed -i "$sig" -e's/^0 //g'
+hash2="$(echo verify $(cat "$sig") | guix authenticate)"
+test "$(echo $hash2 | cut -d : -f 2)" = "$hash"
# Detect corrupt signatures.
-if guix authenticate verify /dev/null
+code="$(echo "verify 5:wrong" | guix authenticate | cut -f1 -d ' ')"
# Detect invalid signatures.
# The signature has (payload (data ... (hash sha256 #...#))). We proceed by
-e's|#[A-Z0-9]\{64\}#|#0000000000000000000000000000000000000000000000000000000000000000#|g'-if guix authenticate verify "$sig"
+code="$(echo "verify $(cat $sig)" | guix authenticate | cut -f1 -d ' ')"
# Test for <http://bugs.gnu.org/17312>: make sure 'guix authenticate' produces
# valid signatures when run in the C locale.
@@ -63,9 +68,11 @@ hash="5eff0b55c9c5f5e87b4e34cd60a2d5654ca1eb78c7b3c67c3179fed1cff07b4c"
-guix authenticate sign "$abs_top_srcdir/tests/signing-key.sec" "$hash" \
+echo "sign $key_len:$key $hash_len:$hash" | guix authenticate > "$sig"
-guix authenticate verify "$sig"
-hash2="`guix authenticate verify "$sig"`"
+# Remove the leading "0".
+sed -i "$sig" -e's/^0 //g'
+echo "verify $(cat $sig)" | guix authenticate
+hash2="$(echo "verify $(cat $sig)" | guix authenticate | cut -f2 -d ' ')"
+test "$(echo $hash2 | cut -d : -f 2)" = "$hash"
diff --git a/tests/store.scm b/tests/store.scm
index 8ff76e8f98..3a2a21a250 100644
;; Ensure 'import-paths' raises an exception.
(guard (c ((store-protocol-error? c)
- (and (not (zero? (store-protocol-error-status (pk 'C c))))
+ (and (not (zero? (store-protocol-error-status c)))
(string-contains (store-protocol-error-message c)
(let* ((source (open-bytevector-input-port dump))
;; Ensure 'import-paths' raises an exception.
(guard (c ((store-protocol-error? c)
- ;; XXX: The daemon-provided error message currently doesn't
- ;; mention the reason of the failure.
- (not (zero? (store-protocol-error-status c)))))
+ (and (not (zero? (store-protocol-error-status c)))
+ (string-contains (store-protocol-error-message c)
+ "unauthorized public key"))))
(let* ((source (open-bytevector-input-port dump))
(imported (import-paths %store source)))
(pk 'unauthorized-imported imported)