WIP: Trustless remote building

NixOS · Aug 12, 2020 · b5f5779 · b5f5779
1 parent 145657c
commit b5f5779
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 5 deletions.
diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
@@ -282,10 +282,21 @@ static int _main(int argc, char * * argv)
 
         uploadLock = -1;
 
-        auto drv = store->readDerivation(*drvPath);
-        drv.inputSrcs = store->parseStorePathSet(inputs);
+        BuildResult result;
 
-        auto result = sshStore->buildDerivation(*drvPath, drv);
+        BasicDerivation drv = store->readDerivation(*drvPath);
+
+        if (sshStore->isTrusting || derivationIsCA(drv.type())) {
+            drv.inputSrcs = store->parseStorePathSet(inputs);
+            result = sshStore->buildDerivation(*drvPath, drv);
+        } else {
+            try {
+                sshStore->buildPaths({{*drvPath}});
+            } catch (Error & e) {
+                result.status = (BuildResult::Status) e.status;
+                result.errorMsg = e.msg();
+            }
+        }
 
         if (!result.success())
             throw Error("build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
@@ -834,7 +834,21 @@ std::map<StorePath, StorePath> copyPaths(ref<Store> srcStore, ref<Store> dstStor
                 MaintainCount<decltype(nrRunning)> mc(nrRunning);
                 showProgress();
                 try {
-                    copyStorePath(srcStore, dstStore, storePath, repair, checkSigs);
+                    if (dstStore->isTrusting || info->ca) {
+                        copyStorePath(srcStore, dstStore, storePath, repair, checkSigs);
+                    } else if (info->deriver && dstStore->storeDir == srcStore->storeDir) {
+                        auto drvPath = *info->deriver;
+                        auto outputMap = srcStore->queryDerivationOutputMap(drvPath);
+                        auto p = std::find_if(outputMap.begin(), outputMap.end(), [&](auto & i) {
+                            return i.second == storePath;
+                        });
+                        dstStore->buildPaths({{
+                            *info->deriver,
+                            p != outputMap.end() ? StringSet { p->first } : StringSet {},
+                        }});
+                    } else {
+                        dstStore->ensurePath(storePath);
+                    }
                 } catch (Error &e) {
                     nrFailed++;
                     if (!settings.keepGoing)

diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
@@ -158,7 +158,9 @@ public:
 
     const Setting<int> pathInfoCacheSize{this, 65536, "path-info-cache-size", "size of the in-memory store path information cache"};
 
-    const Setting<bool> isTrusted{this, false, "trusted", "whether paths from this store can be used as substitutes even when they lack trusted signatures"};
+    const Setting<bool> isTrusted{this, false, "trusted", "whether paths from this store can be used as substitutes even when they lack trusted signatures. The dual of \"trusting\""};
+
+    Setting<bool> isTrusting{this, true, "trusting", "whether (we think) paths an be be added to this store even when they lack trusted signatures. The dual of \"trusted\""};
 
     Setting<int> priority{this, 0, "priority", "priority of this substituter (lower value means higher priority)"};