Find a file
Adam Joseph e43bb655fe libstore/daemon.cc: note trust model difference in readDerivation()s
Below the comment added by this commit is a much longer comment
followed by a trust check, both of which have confused me on at
least two occasions.  I figured it out once, forgot it, then had to
ask @Ericson2314 to explain it, at which point I understood it
again.  I think this might confuse other people too, or maybe I will
just forget it a third time.  So let's add a comment.

Farther down in the function is the following check:

```
if (!(drvType.isCA() || trusted))
  throw Error("you are not privileged to build input-addressed derivations");
```

This seems really strange at first.  A key property of Nix is that
you can compute the outpath of a derivation using the derivation
(and its references-closure) without trusting anybody!

The missing insight is that at this point in the code the builder
doesn't necessarily have the references-closure of the derivation
being built, and therefore needs to trust that the derivation's
outPath is honest.  It's incredibly easy to overlook this, because
the only difference between these two cases is which of these
identically-named functions we used:

- `readDerivation(Source,Store)`
- `Store::readDerivation()`

These functions have different trust models (except in the special
case where the first function is used on the local store).  We
should call the reader's attention to this fact.

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
2023-12-10 17:47:07 -08:00
.github Fix the labeler.yml config file 2023-12-06 14:07:08 +01:00
config Run autoupdate 2021-06-01 11:42:38 +02:00
contrib function-trace: always show the trace 2019-09-18 23:23:21 +02:00
doc document fetchTree (#9258) 2023-12-10 05:16:32 +00:00
m4 Add configure test to ensure GCC bug is fixed 2023-10-31 12:09:46 -04:00
maintainers maintainers/release-notes: Improve DATE check 2023-11-27 15:18:29 +01:00
misc changelog-d: Use roberth fork with markdown frontmatter support 2023-12-09 19:50:33 +01:00
mk Move tests to separate directories, and document 2023-12-01 10:48:58 -05:00
perl Store.xs: fix references to HashFormat::Nix32 2023-12-06 23:43:42 +01:00
scripts maintainers/release-notes <- scripts/release-notes 2023-11-24 16:53:33 +01:00
src libstore/daemon.cc: note trust model difference in readDerivation()s 2023-12-10 17:47:07 -08:00
tests Create ServeProto::BuildOptions and a serializer for it 2023-12-09 11:35:13 -05:00
.dir-locals.el .dir-locals.el: Set c-block-comment-prefix 2020-07-10 11:21:06 +02:00
.editorconfig .editorconfig: Also affect Perl FFI xs file 2023-11-09 23:11:52 -05:00
.gitignore Move tests to separate directories, and document 2023-12-01 10:48:58 -05:00
.version Bump version 2023-11-20 15:06:28 +01:00
boehmgc-coroutine-sp-fallback.diff Fix boehmgc-coroutine-sp-fallback.diff for FreeBSD 2023-09-20 09:04:42 -04:00
boehmgc-traceable_allocator-public.diff Use boost::container::small_vector in place of VLAs 2023-11-21 20:52:27 +01:00
configure.ac Improve ACL clearing support (fixing FreeBSD build) 2023-11-29 21:09:19 -05:00
CONTRIBUTING.md Merge pull request #9182 from fricklerhandwerk/popular-issues 2023-10-19 16:25:36 -04:00
COPYING * Change this to LGPL to keep the government happy. 2006-04-25 16:41:06 +00:00
default.nix add flake-compat to flake.nix and use sha256 in default.nix 2023-03-06 21:11:24 +01:00
docker.nix fix "add an option to include flake-registry..." 2023-05-16 14:35:31 +02:00
flake.lock flake.lock: Update Nixpkgs to fix static build 2023-12-01 15:59:41 -05:00
flake.nix flake.nix: Cache shell inputs through hydra 2023-12-09 21:22:20 +01:00
local.mk Use positive source filtering for the standalone functional tests job 2023-10-09 08:29:27 -04:00
Makefile Including config.h also needs $(buildprefix) 2023-12-05 16:36:12 -05:00
Makefile.config.in Merge remote-tracking branch 'upstream/master' into libgit2 2023-11-20 08:30:26 -05:00
precompiled-headers.h Config: Use nlohmann/json 2020-08-20 11:02:16 +02:00
README.md fix: Remove extra to from README.md (#9213) 2023-10-23 19:20:23 +02:00
shell.nix Remove url literals 2022-01-24 13:28:21 +01:00

Nix

Open Collective supporters Test

Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. Please refer to the Nix manual for more details.

Installation and first steps

Visit nix.dev for installation instructions and beginner tutorials.

Full reference documentation can be found in the Nix manual.

Building And Developing

See our Hacking guide in our manual for instruction on how to set up a development environment and build Nix from source.

Contributing

Check the contributing guide if you want to get involved with developing Nix.

Additional Resources

License

Nix is released under the LGPL v2.1.