summaryrefslogtreecommitdiff
path: root/guix/scripts
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2015-07-20 04:30:16 +0200
committerLudovic Courtès <ludo@gnu.org>2016-11-16 18:19:47 +0100
commit94d92c7796a3dd50c27d532315f7d497ac99f08e (patch)
tree505902f5583fe528ceceacfd15d1f43828c4ad79 /guix/scripts
parent17ab08bcf0ae27ec6a1f07766080ebfbea8837d9 (diff)
daemon: Add "builtin:download" derivation builder.
This ensures that 1) the derivation doesn't change when Guix changes; 2) the derivation closure doesn't contain Guix and its dependencies; 3) we don't have to rely on ugly chroot hacks. Adapted from Nix commit 0a2bee307b20411f5b0dda0c662b1f9bb9e0e131. * nix/libstore/build.cc (DerivationGoal::runChild): Add special case for 'isBuiltin(drv)'. Disable chroot when 'isBuiltin(drv)'. * nix/libstore/builtins.cc, nix/libstore/builtins.hh, nix/scripts/download.in, guix/scripts/perform-download.scm: New files. * guix/ui.scm (show-guix-help)[internal?]: Add 'perform-download'. * nix/local.mk (libstore_a_SOURCES): Add builtins.cc. (libstore_headers): Add builtins.hh. (nodist_pkglibexec_SCRIPTS): Add 'scripts/download'. * config-daemon.ac: Emit 'scripts/download'. * Makefile.am (MODULES): Add 'guix/scripts/perform-download.scm'. * tests/derivations.scm ("unknown built-in builder") ("'download' built-in builder") ("'download' built-in builder, invalid hash") ("'download' built-in builder, not found") ("'download' built-in builder, not fixed-output"): New tests. Co-authored-by: Eelco Dolstra <eelco.dolstra@logicblox.com>
Diffstat (limited to 'guix/scripts')
-rw-r--r--guix/scripts/perform-download.scm113
1 files changed, 113 insertions, 0 deletions
diff --git a/guix/scripts/perform-download.scm b/guix/scripts/perform-download.scm
new file mode 100644
index 0000000000..0d2e7089aa
--- /dev/null
+++ b/guix/scripts/perform-download.scm
@@ -0,0 +1,113 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (guix scripts perform-download)
+ #:use-module (guix ui)
+ #:use-module (guix derivations)
+ #:use-module ((guix store) #:select (derivation-path?))
+ #:use-module (guix build download)
+ #:use-module (ice-9 match)
+ #:export (guix-perform-download))
+
+;; This program is a helper for the daemon's 'download' built-in builder.
+
+(define-syntax derivation-let
+ (syntax-rules ()
+ ((_ drv ((id name) rest ...) body ...)
+ (let ((id (assoc-ref (derivation-builder-environment-vars drv)
+ name)))
+ (derivation-let drv (rest ...) body ...)))
+ ((_ drv () body ...)
+ (begin body ...))))
+
+(define %user-module
+ ;; Module in which content-address mirror procedures are evaluated.
+ (let ((module (make-fresh-user-module)))
+ (module-use! module (resolve-interface '(guix base32)))
+ module))
+
+(define (perform-download drv)
+ "Perform the download described by DRV, a fixed-output derivation."
+ (derivation-let drv ((url "url")
+ (output "out")
+ (executable "executable")
+ (mirrors "mirrors")
+ (content-addressed-mirrors "content-addressed-mirrors"))
+ (unless url
+ (leave (_ "~a: missing URL~%") (derivation-file-name drv)))
+
+ (let* ((url (call-with-input-string url read))
+ (drv-output (assoc-ref (derivation-outputs drv) "out"))
+ (algo (derivation-output-hash-algo drv-output))
+ (hash (derivation-output-hash drv-output)))
+ (unless (and algo hash)
+ (leave (_ "~a is not a fixed-output derivation~%")
+ (derivation-file-name drv)))
+
+ ;; We're invoked by the daemon, which gives us write access to OUTPUT.
+ (when (url-fetch url output
+ #:mirrors (if mirrors
+ (call-with-input-file mirrors read)
+ '())
+ #:content-addressed-mirrors
+ (if content-addressed-mirrors
+ (call-with-input-file content-addressed-mirrors
+ (lambda (port)
+ (eval (read port) %user-module)))
+ '())
+ #:hashes `((,algo . ,hash))
+
+ ;; Since DRV's output hash is known, X.509 certificate
+ ;; validation is pointless.
+ #:verify-certificate? #f)
+ (when (and executable (string=? executable "1"))
+ (chmod output #o755))))))
+
+(define (assert-low-privileges)
+ (when (zero? (getuid))
+ (leave (_ "refusing to run with elevated privileges (UID ~a)~%")
+ (getuid))))
+
+(define (guix-perform-download . args)
+ "Perform the download described by the given fixed-output derivation.
+
+This is an \"out-of-band\" download in that this code is executed directly by
+the daemon and not explicitly described as an input of the derivation. This
+allows us to sidestep bootstrapping problems, such downloading the source code
+of GnuTLS over HTTPS, before we have built GnuTLS. See
+<http://bugs.gnu.org/22774>."
+ (with-error-handling
+ (match args
+ (((? derivation-path? drv))
+ ;; This program must be invoked by guix-daemon under an unprivileged
+ ;; UID to prevent things downloading from 'file:///etc/shadow' or
+ ;; arbitrary code execution via the content-addressed mirror
+ ;; procedures. (That means we exclude users who did not pass
+ ;; '--build-users-group'.)
+ (assert-low-privileges)
+ (perform-download (call-with-input-file drv read-derivation)))
+ (("--version")
+ (show-version-and-exit))
+ (x
+ (leave (_ "fixed-output derivation name expected~%"))))))
+
+;; Local Variables:
+;; eval: (put 'derivation-let 'scheme-indent-function 2)
+;; End:
+
+;; perform-download.scm ends here