Re: Signed archives (preliminary patch)

[ludo@gnu.org (Ludovic Courtès)]

ludo@gnu.org (Ludovic Courtès) skribis:

> Nikita Karetnikov <nikita@karetnikov.org> skribis:

[...]

>> +                (raise (condition (&message (message "invalid hash"))
>> +                                  (&nar-invalid-hash-error
>> +                                   (port port) (file file)
>> +                                   (signature signature)
>> +                                   (expected (hash-data->bytevector data))
>> +                                   (actual hash)))))
>> +            (raise (condition (&message (message "unauthorized public key"))
>> +                              (&nar-signature-error
>> +                               (signature signature) (file file) (port port)))))
>> +        (raise (condition
>> +                (&message (message "corrupt signature data"))
>> +                (&nar-signature-error
>> +                 (signature signature) (file file) (port port)))))))
>
> Actually, the problem with making ‘assert-valid-signature’ public is
> that it raises &nar error conditions.
>
> It could be changed to raise a more generic &signature-error, but then
> ‘restore-file-set’ would have to guard against it to re-throw it along
> with a &nar-error (making a compound condition.)  And then ui.scm would
> figure it out.  Blech.
>
> It’s worth factorizing, but I don’t see how to do it nicely.  Thoughts?

I ended up introducing a ‘signature-case’ macro in 81deef2.  It
simplifies code, and fails to compile unless all the cases are covered.

In (guix scripts substitute-binary), the result looks like this:

  (define* (assert-valid-signature narinfo signature hash
                                   #:optional (acl (current-acl)))
    (let ((uri (uri->string (narinfo-uri narinfo))))
      (signature-case (signature hash acl)
        (valid-signature #t)
        (invalid-signature
         (leave (_ "invalid signature for '~a'~%") uri))
        (hash-mismatch
         (leave (_ "hash mismatch for '~a'~%") uri))
        (unauthorized-key
         (leave (_ "'~a' is signed with an unauthorized key~%") uri))
        (corrupt-signature
         (leave (_ "signature on '~a' is corrupt~%") uri)))))

Ludo’.