[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
18/24: services: childhurd: Authorize the childhurd’s key on the host.
From: |
guix-commits |
Subject: |
18/24: services: childhurd: Authorize the childhurd’s key on the host. |
Date: |
Fri, 29 Sep 2023 06:10:55 -0400 (EDT) |
janneke pushed a commit to branch hurd-team
in repository guix.
commit 43e2867f961866759a9be542de7c208233bc2b38
Author: Ludovic Courtès <ludo@gnu.org>
AuthorDate: Fri Sep 22 14:54:08 2023 +0200
services: childhurd: Authorize the childhurd’s key on the host.
This partly automates setting up a childhurd for offloading purposes.
* gnu/services/virtualization.scm (authorize-guest-substitutes-on-host):
New procedure.
(hurd-vm-activation): Use it.
---
gnu/services/virtualization.scm | 51 ++++++++++++++++++++++++++++++++++++++++-
1 file changed, 50 insertions(+), 1 deletion(-)
diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm
index fd153dd051..ca000f5d28 100644
--- a/gnu/services/virtualization.scm
+++ b/gnu/services/virtualization.scm
@@ -28,6 +28,7 @@
#:use-module (gnu image)
#:use-module (gnu packages admin)
#:use-module (gnu packages gdb)
+ #:autoload (gnu packages gnupg) (guile-gcrypt)
#:use-module (gnu packages package-management)
#:use-module (gnu packages ssh)
#:use-module (gnu packages virtualization)
@@ -50,6 +51,7 @@
#:use-module (guix records)
#:use-module (guix store)
#:use-module (guix utils)
+ #:autoload (guix self) (make-config.scm)
#:use-module (srfi srfi-9)
#:use-module (srfi srfi-26)
@@ -1271,6 +1273,50 @@ is added to the OS specified in CONFIG."
(program-file "initialize-hurd-vm-substitutes" run))
+(define (authorize-guest-substitutes-on-host)
+ "Return a program that authorizes the guest's archive signing key (passed as
+an argument) on the host."
+ (define not-config?
+ (match-lambda
+ ('(guix config) #f)
+ (('guix _ ...) #t)
+ (('gnu _ ...) #t)
+ (_ #f)))
+
+ (define run
+ (with-extensions (list guile-gcrypt)
+ (with-imported-modules `(((guix config) => ,(make-config.scm))
+ ,@(source-module-closure
+ '((guix pki)
+ (guix build utils))
+ #:select? not-config?))
+ #~(begin
+ (use-modules (ice-9 match)
+ (ice-9 textual-ports)
+ (gcrypt pk-crypto)
+ (guix pki)
+ (guix build utils))
+
+ (match (command-line)
+ ((_ guest-config-directory)
+ (let ((guest-key (string-append guest-config-directory
+ "/signing-key.pub")))
+ (if (file-exists? guest-key)
+ ;; Add guest key to the host's ACL.
+ (let* ((key (string->canonical-sexp
+ (call-with-input-file guest-key
+ get-string-all)))
+ (acl (public-keys->acl
+ (cons key (acl->public-keys
(current-acl))))))
+ (with-atomic-file-replacement %acl-file
+ (lambda (_ port)
+ (write-acl acl port))))
+ (format (current-error-port)
+ "warning: guest key missing from '~a'~%"
+ guest-key)))))))))
+
+ (program-file "authorize-guest-substitutes-on-host" run))
+
(define (hurd-vm-activation config)
"Return a gexp to activate the Hurd VM according to CONFIG."
(with-imported-modules '((guix build utils))
@@ -1294,7 +1340,10 @@ is added to the OS specified in CONFIG."
(unless (file-exists? guix-directory)
(invoke #$(initialize-hurd-vm-substitutes)
- guix-directory)))))
+ guix-directory))
+
+ ;; Authorize the archive signing key from GUIX-DIRECTORY in the host.
+ (invoke #$(authorize-guest-substitutes-on-host) guix-directory))))
(define hurd-vm-service-type
(service-type
- 14/24: services: hurd-vm: Use the default SSH port number., (continued)
- 14/24: services: hurd-vm: Use the default SSH port number., guix-commits, 2023/09/29
- 15/24: gnu: glibc-utf8-locales: Reintroduce input labels., guix-commits, 2023/09/29
- 12/24: system: vm: Remove unused variable., guix-commits, 2023/09/29
- 13/24: secret-service: Increase default handshake timeout., guix-commits, 2023/09/29
- 03/24: system: hurd: Add swap-services to hurd-default-essential-services., guix-commits, 2023/09/29
- 11/24: Revert "system: bare-hurd.tmpl: Include glibc-2.33 locales in cross-build.", guix-commits, 2023/09/29
- 08/24: DRAFT daemon: Support chroot builds on GNU/Hurd., guix-commits, 2023/09/29
- 09/24: Revert "DRAFT daemon: Support chroot builds on GNU/Hurd.", guix-commits, 2023/09/29
- 10/24: system: bare-hurd.tmpl: Include glibc-2.33 locales in cross-build., guix-commits, 2023/09/29
- 17/24: services: guix: Support declarative offloading setup., guix-commits, 2023/09/29
- 18/24: services: childhurd: Authorize the childhurd’s key on the host.,
guix-commits <=
- 19/24: services: hurd-vm: ‘image’ field has to be an <image> record., guix-commits, 2023/09/29
- 20/24: tests: hurd-vm: Remove custom disk image configuration., guix-commits, 2023/09/29
- 21/24: services: hurd-vm: Disable password-based authentication for root., guix-commits, 2023/09/29
- 22/24: doc: Give an example showing how to add an account in the childhurd., guix-commits, 2023/09/29
- 16/24: services: guix: Use the right locale package on GNU/Hurd., guix-commits, 2023/09/29
- 23/24: services: hurd-vm: Implement zero-configuration offloading., guix-commits, 2023/09/29
- 24/24: gnu: guix: Update to 1.4.0-12.449ed59b54., guix-commits, 2023/09/29