Inheritance diagram for nix::RestrictedStore:

Collaboration diagram for nix::RestrictedStore:

Public Member Functions
RestrictedStoreConfig &	config () override

const RestrictedStoreConfig &	config () const override

	RestrictedStore (RestrictedStoreConfig config, ref< LocalStore > next, LocalDerivationGoal &goal)

Path	getRealStoreDir () override

std::string	getUri () override

kj::Promise< Result< StorePathSet > >	queryAllValidPaths () override

kj::Promise< Result< std::shared_ptr< const ValidPathInfo > > >	queryPathInfoUncached (const StorePath &path) override

kj::Promise< Result< void > >	queryReferrers (const StorePath &path, StorePathSet &referrers) override

kj::Promise< Result< std::map< std::string, std::optional< StorePath > > > >	queryPartialDerivationOutputMap (const StorePath &path, Store *evalStore=nullptr) override

kj::Promise< Result< std::optional< StorePath > > >	queryPathFromHashPart (const std::string &hashPart) override

kj::Promise< Result< StorePath > >	addToStoreRecursive (std::string_view name, const PreparedDump &source, HashType hashAlgo, RepairFlag repair) override

kj::Promise< Result< StorePath > >	addToStoreFlat (std::string_view name, const Path &srcPath, HashType hashAlgo, RepairFlag repair) override

kj::Promise< Result< void > >	addToStore (const ValidPathInfo &info, AsyncInputStream &narSource, RepairFlag repair=NoRepair, CheckSigsFlag checkSigs=CheckSigs) override

kj::Promise< Result< StorePath > >	addTextToStore (std::string_view name, std::string_view s, const StorePathSet &references, RepairFlag repair=NoRepair) override

kj::Promise< Result< StorePath > >	addToStoreFromDump (AsyncInputStream &dump, std::string_view name, FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet &references) override

kj::Promise< Result< box_ptr< Source > > >	narFromPath (const StorePath &path) override

kj::Promise< Result< void > >	ensurePath (const StorePath &path) override

kj::Promise< Result< void > >	registerDrvOutput (const Realisation &info) override

kj::Promise< Result< std::shared_ptr< const Realisation > > >	queryRealisationUncached (const DrvOutput &id) override

kj::Promise< Result< void > >	buildPaths (const std::vector< DerivedPath > &paths, BuildMode buildMode, std::shared_ptr< Store > evalStore) override

kj::Promise< Result< std::vector< KeyedBuildResult > > >	buildPathsWithResults (const std::vector< DerivedPath > &paths, BuildMode buildMode=bmNormal, std::shared_ptr< Store > evalStore=nullptr) override

kj::Promise< Result< BuildResult > >	buildDerivation (const StorePath &drvPath, const BasicDerivation &drv, BuildMode buildMode=bmNormal) override

kj::Promise< Result< void > >	addTempRoot (const StorePath &path) override

kj::Promise< Result< void > >	addIndirectRoot (const Path &path) override

kj::Promise< Result< Roots > >	findRoots (bool censor) override

kj::Promise< Result< void > >	collectGarbage (const GCOptions &options, GCResults &results) override

kj::Promise< Result< void > >	addSignatures (const StorePath &storePath, const StringSet &sigs) override

kj::Promise< Result< void > >	queryMissing (const std::vector< DerivedPath > &targets, StorePathSet &willBuild, StorePathSet &willSubstitute, StorePathSet &unknown, uint64_t &downloadSize, uint64_t &narSize) override

virtual kj::Promise< Result< std::optional< std::string > > >	getBuildLogExact (const StorePath &path) override

virtual kj::Promise< Result< void > >	addBuildLog (const StorePath &path, std::string_view log) override

kj::Promise< Result< std::optional< TrustedFlag > > >	isTrustedClient () override

Public Member Functions inherited from nix::IndirectRootStore
kj::Promise< Result< Path > >	addPermRoot (const StorePath &storePath, const Path &gcRoot) override final

Public Member Functions inherited from nix::LocalFSStore
ref< FSAccessor >	getFSAccessor () override

Path	toRealPath (const Path &storePath) override

Public Member Functions inherited from nix::Store
virtual kj::Promise< Result< void > >	init ()

StorePath	parseStorePath (std::string_view path) const

std::optional< StorePath >	maybeParseStorePath (std::string_view path) const

std::string	printStorePath (const StorePath &path) const

StorePathSet	parseStorePathSet (const PathSet &paths) const

PathSet	printStorePathSet (const StorePathSet &path) const

std::string	showPaths (const StorePathSet &paths)

bool	isInStore (PathView path) const

bool	isStorePath (std::string_view path) const

std::pair< StorePath, Path >	toStorePath (PathView path) const

Path	followLinksToStore (std::string_view path) const

StorePath	followLinksToStorePath (std::string_view path) const

StorePath	makeStorePath (std::string_view type, std::string_view hash, std::string_view name) const

StorePath	makeStorePath (std::string_view type, const Hash &hash, std::string_view name) const

StorePath	makeOutputPath (std::string_view id, const Hash &hash, std::string_view name) const

StorePath	makeFixedOutputPath (std::string_view name, const FixedOutputInfo &info) const

StorePath	makeTextPath (std::string_view name, const TextInfo &info) const

StorePath	makeFixedOutputPathFromCA (std::string_view name, const ContentAddressWithReferences &ca) const

StorePath	computeStorePathForPathRecursive (std::string_view name, const PreparedDump &source) const

StorePath	computeStorePathForPathFlat (std::string_view name, const Path &srcPath) const

StorePath	computeStorePathForText (std::string_view name, std::string_view s, const StorePathSet &references) const

kj::Promise< Result< bool > >	isValidPath (const StorePath &path)

kj::Promise< Result< void > >	substitutePaths (const StorePathSet &paths)

virtual kj::Promise< Result< StorePathSet > >	queryValidPaths (const StorePathSet &paths, SubstituteFlag maybeSubstitute=NoSubstitute)

kj::Promise< Result< ref< const ValidPathInfo > > >	queryPathInfo (const StorePath &path)

kj::Promise< Result< std::shared_ptr< const Realisation > > >	queryRealisation (const DrvOutput &)

virtual bool	pathInfoIsUntrusted (const ValidPathInfo &)

virtual bool	realisationIsUntrusted (const Realisation &)

virtual kj::Promise< Result< StorePathSet > >	queryValidDerivers (const StorePath &path)

virtual kj::Promise< Result< StorePathSet > >	queryDerivationOutputs (const StorePath &path)

virtual kj::Promise< Result< std::map< std::string, std::optional< StorePath > > > >	queryStaticPartialDerivationOutputMap (const StorePath &path)

kj::Promise< Result< OutputPathMap > >	queryDerivationOutputMap (const StorePath &path, Store *evalStore=nullptr)

virtual kj::Promise< Result< StorePathSet > >	querySubstitutablePaths (const StorePathSet &paths)

virtual kj::Promise< Result< void > >	querySubstitutablePathInfos (const StorePathCAMap &paths, SubstitutablePathInfos &infos)

virtual kj::Promise< Result< void > >	addMultipleToStore (PathsSource &pathsToCopy, Activity &act, RepairFlag repair=NoRepair, CheckSigsFlag checkSigs=CheckSigs)

kj::Promise< Result< ValidPathInfo > >	addToStoreSlow (std::string_view name, const Path &srcPath, FileIngestionMethod method=FileIngestionMethod::Recursive, HashType hashAlgo=HashType::SHA256, std::optional< Hash > expectedCAHash={})

virtual kj::Promise< Result< void > >	registerDrvOutput (const Realisation &output, CheckSigsFlag checkSigs)

kj::Promise< Result< std::string > >	makeValidityRegistration (const StorePathSet &paths, bool showDerivers, bool showHash)

kj::Promise< Result< JSON > >	pathInfoToJSON (const StorePathSet &storePaths, bool includeImpureInfo, bool showClosureSize, Base hashBase=Base::Base32, AllowInvalidFlag allowInvalid=DisallowInvalid)

kj::Promise< Result< std::pair< uint64_t, uint64_t > > >	getClosureSize (const StorePath &storePath)

virtual kj::Promise< Result< void > >	optimiseStore ()

virtual kj::Promise< Result< bool > >	verifyStore (bool checkContents, RepairFlag repair=NoRepair)

virtual kj::Promise< Result< void > >	repairPath (const StorePath &path)

kj::Promise< Result< Derivation > >	derivationFromPath (const StorePath &drvPath)

kj::Promise< Result< Derivation > >	readDerivation (const StorePath &drvPath)

kj::Promise< Result< Derivation > >	readInvalidDerivation (const StorePath &drvPath)

virtual kj::Promise< Result< void > >	computeFSClosure (const StorePathSet &paths, StorePathSet &out, bool flipDirection=false, bool includeOutputs=false, bool includeDerivers=false)

kj::Promise< Result< void > >	computeFSClosure (const StorePath &path, StorePathSet &out, bool flipDirection=false, bool includeOutputs=false, bool includeDerivers=false)

kj::Promise< Result< StorePaths > >	topoSortPaths (const StorePathSet &paths)

kj::Promise< Result< void > >	exportPaths (const StorePathSet &paths, Sink &sink)

kj::Promise< Result< void > >	exportPath (const StorePath &path, Sink &sink)

kj::Promise< Result< StorePaths > >	importPaths (Source &source, CheckSigsFlag checkSigs=CheckSigs)

kj::Promise< Result< Stats<> > >	getStats ()

kj::Promise< Result< StorePathSet > >	exportReferences (const StorePathSet &storePaths, const StorePathSet &inputPaths)

kj::Promise< Result< std::optional< StorePath > > >	getBuildDerivationPath (const StorePath &)

kj::Promise< void >	clearPathInfoCache ()

virtual kj::Promise< Result< void > >	connect ()

virtual kj::Promise< Result< unsigned int > >	getProtocol ()

Path	toRealPath (const StorePath &storePath)

virtual kj::Promise< Result< void > >	setOptions ()

virtual kj::Promise< Result< std::optional< std::string > > >	getVersion ()

Public Member Functions inherited from nix::LogStore
kj::Promise< Result< std::optional< std::string > > >	getBuildLog (const StorePath &path)

Public Attributes
RestrictedStoreConfig	config_

ref< LocalStore >	next

LocalDerivationGoal &	goal

Additional Inherited Members
Public Types inherited from nix::Store
using	PathsSource

Static Public Member Functions inherited from nix::LogStore
static LogStore &	require (Store &store)

Static Public Attributes inherited from nix::IndirectRootStore
static std::string	operationName = "Indirect GC roots registration"

Static Public Attributes inherited from nix::LocalFSStore
static std::string	operationName = "Local Filesystem Store"

static const std::string	drvsLogDir = "drvs"

Static Public Attributes inherited from nix::Store
static constexpr const char *	MissingName = "x"

Static Public Attributes inherited from nix::GcStore
static std::string	operationName = "Garbage collection"

Static Public Attributes inherited from nix::LogStore
static std::string	operationName = "Build log storage and retrieval"

Protected Member Functions inherited from nix::Store
	Store (const StoreConfig &config)

virtual kj::Promise< Result< bool > >	isValidPathUncached (const StorePath &path)

void	unsupported (const std::string &op)

Protected Attributes inherited from nix::Store
Sync< State, AsyncMutex >	state

std::shared_ptr< NarInfoDiskCache >	diskCache

Stats< std::atomic >	stats

Member Function Documentation

◆ addBuildLog()

virtual kj::Promise< Result< void > > nix::RestrictedStore::addBuildLog	(	const StorePath &	path,
		std::string_view	log )

inlineoverridevirtual

Implements nix::LogStore.

◆ addIndirectRoot()

kj::Promise< Result< void > > nix::RestrictedStore::addIndirectRoot ( const Path & path )

inlineoverridevirtual

Add an indirect root, which is a weak reference to the user-facing symlink created by addPermRoot().

Parameters

path	user-facing and user-controlled symlink to a store path.

The form this weak-reference takes is implementation-specific.

Implements nix::IndirectRootStore.

◆ addSignatures()

kj::Promise< Result< void > > nix::RestrictedStore::addSignatures	(	const StorePath &	storePath,
		const StringSet &	sigs )

inlineoverridevirtual

Add signatures to the specified store path. The signatures are not verified.

Reimplemented from nix::Store.

◆ addTempRoot()

kj::Promise< Result< void > > nix::RestrictedStore::addTempRoot ( const StorePath & path )

inlineoverridevirtual

Add a store path as a temporary root of the garbage collector. The root disappears as soon as we exit.

Reimplemented from nix::Store.

◆ addTextToStore()

kj::Promise< Result< StorePath > > nix::RestrictedStore::addTextToStore	(	std::string_view	name,
		std::string_view	s,
		const StorePathSet &	references,
		RepairFlag	repair = NoRepair )

inlineoverridevirtual

Like addToStore, but the contents written to the output path is a regular file containing the given string.

Implements nix::Store.

◆ addToStore()

kj::Promise< Result< void > > nix::RestrictedStore::addToStore	(	const ValidPathInfo &	info,
		AsyncInputStream &	narSource,
		RepairFlag	repair = NoRepair,
		CheckSigsFlag	checkSigs = CheckSigs )

inlineoverridevirtual

Import a path into the store.

Implements nix::Store.

◆ addToStoreFlat()

kj::Promise< Result< StorePath > > nix::RestrictedStore::addToStoreFlat	(	std::string_view	name,
		const Path &	srcPath,
		HashType	hashAlgo,
		RepairFlag	repair )

inlineoverridevirtual

Reimplemented from nix::Store.

◆ addToStoreFromDump()

kj::Promise< Result< StorePath > > nix::RestrictedStore::addToStoreFromDump	(	AsyncInputStream &	dump,
		std::string_view	name,
		FileIngestionMethod	method,
		HashType	hashAlgo,
		RepairFlag	repair,
		const StorePathSet &	references )

inlineoverridevirtual

Like addToStore(), but the contents of the path are contained in dump, which is either a NAR serialisation (if recursive == true) or simply the contents of a regular file (if recursive == false). dump may be drained

Todo: remove?

Reimplemented from nix::Store.

◆ addToStoreRecursive()

kj::Promise< Result< StorePath > > nix::RestrictedStore::addToStoreRecursive	(	std::string_view	name,
		const PreparedDump &	source,
		HashType	hashAlgo,
		RepairFlag	repair )

inlineoverridevirtual

Copy the contents of a path to the store and register the validity the resulting path.

Returns: The resulting path is returned.

Parameters

filter This function can be used to exclude files (see libutil/archive.hh).

Reimplemented from nix::Store.

◆ buildDerivation()

kj::Promise< Result< BuildResult > > nix::RestrictedStore::buildDerivation	(	const StorePath &	drvPath,
		const BasicDerivation &	drv,
		BuildMode	buildMode = bmNormal )

inlineoverridevirtual

Build a single non-materialized derivation (i.e. not from an on-disk .drv file).

Parameters

drvPath This is used to deduplicate worker goals so it is imperative that is correct. That said, it doesn't literally need to be store path that would be calculated from writing this derivation to the store: it is OK if it instead is that of a Derivation which would resolve to this (by taking the outputs of it's input derivations and adding them as input sources) such that the build time referenceable-paths are the same.

In the input-addressed case, we usually do use an "original" unresolved derivations's path, as that is what will be used in the buildPaths case. Also, the input-addressed output paths are verified only by that contents of that specific unresolved derivation, so it is nice to keep that information around so if the original derivation is ever obtained later, it can be verified whether the trusted user in fact used the proper output path.

In the content-addressed case, we want to always use the resolved drv path calculated from the provided derivation. This serves two purposes:

It keeps the operation trustless, by ruling out a maliciously invalid drv path corresponding to a non-resolution-equivalent derivation.
For the floating case in particular, it ensures that the derivation to output mapping respects the resolution equivalence relation, so one cannot choose different resolution-equivalent derivations to subvert dependency coherence (i.e. the property that one doesn't end up with multiple different versions of dependencies without explicitly choosing to allow it).

Reimplemented from nix::Store.

◆ buildPaths()

kj::Promise< Result< void > > nix::RestrictedStore::buildPaths	(	const std::vector< DerivedPath > &	paths,
		BuildMode	buildMode,
		std::shared_ptr< Store >	evalStore )

inlineoverridevirtual

For each path, if it's a derivation, build it. Building a derivation means ensuring that the output paths are valid. If they are already valid, this is a no-op. Otherwise, validity can be reached in two ways. First, if the output paths is substitutable, then build the path that way. Second, the output paths can be created by running the builder, after recursively building any sub-derivations. For inputs that are not derivations, substitute them.

Reimplemented from nix::Store.

◆ buildPathsWithResults()

kj::Promise< Result< std::vector< KeyedBuildResult > > > nix::RestrictedStore::buildPathsWithResults	(	const std::vector< DerivedPath > &	paths,
		BuildMode	buildMode = bmNormal,
		std::shared_ptr< Store >	evalStore = nullptr )

inlineoverridevirtual

Like buildPaths(), but return a vector of BuildResult BuildResults corresponding to each element in paths. Note that in case of a build/substitution error, this function won't throw an exception, but return a BuildResult containing an error message.

Reimplemented from nix::Store.

◆ collectGarbage()

kj::Promise< Result< void > > nix::RestrictedStore::collectGarbage	(	const GCOptions &	options,
		GCResults &	results )

inlineoverridevirtual

Perform a garbage collection.

Implements nix::GcStore.

◆ config() [1/2]

const RestrictedStoreConfig & nix::RestrictedStore::config ( ) const

inlineoverridevirtual

Implements nix::LocalFSStore.

◆ config() [2/2]

RestrictedStoreConfig & nix::RestrictedStore::config ( )

inlineoverridevirtual

Implements nix::LocalFSStore.

◆ ensurePath()

kj::Promise< Result< void > > nix::RestrictedStore::ensurePath ( const StorePath & path )

inlineoverridevirtual

Ensure that a path is valid. If it is not currently valid, it may be made valid by running a substitute (if defined for the path).

Reimplemented from nix::Store.

◆ findRoots()

kj::Promise< Result< Roots > > nix::RestrictedStore::findRoots ( bool censor )

inlineoverridevirtual

Find the roots of the garbage collector. Each root is a pair (link, storepath) where link is the path of the symlink outside of the Nix store that point to storePath. If censor is true, privacy-sensitive information about roots found in /proc is censored.

Implements nix::GcStore.

◆ getBuildLogExact()

virtual kj::Promise< Result< std::optional< std::string > > > nix::RestrictedStore::getBuildLogExact ( const StorePath & path )

inlineoverridevirtual

Reimplemented from nix::LocalFSStore.

◆ getRealStoreDir()

Path nix::RestrictedStore::getRealStoreDir ( )

inlineoverridevirtual

Reimplemented from nix::LocalFSStore.

◆ getUri()

std::string nix::RestrictedStore::getUri ( )

inlineoverridevirtual

Implements nix::Store.

◆ isTrustedClient()

kj::Promise< Result< std::optional< TrustedFlag > > > nix::RestrictedStore::isTrustedClient ( )

inlineoverridevirtual

Returns: / whether store trusts us.

std::nullopt means we do not know.

Note: This is the opposite of the StoreConfig::isTrusted store setting. That is about whether we trust the store.

Implements nix::Store.

◆ narFromPath()

kj::Promise< Result< box_ptr< Source > > > nix::RestrictedStore::narFromPath ( const StorePath & path )

inlineoverridevirtual

Generate a NAR dump of a store path.

Reimplemented from nix::LocalFSStore.

◆ queryAllValidPaths()

kj::Promise< Result< StorePathSet > > nix::RestrictedStore::queryAllValidPaths ( )

inlineoverridevirtual

Query the set of all valid paths. Note that for some store backends, the name part of store paths may be replaced by 'x' (i.e. you'll get /nix/store/<hash>-x rather than /nix/store/<hash>-<name>). Use queryPathInfo() to obtain the full store path. FIXME: should return a set of std::variant<StorePath, HashPart> to get rid of this hack.

Reimplemented from nix::Store.

◆ queryMissing()

kj::Promise< Result< void > > nix::RestrictedStore::queryMissing	(	const std::vector< DerivedPath > &	targets,
		StorePathSet &	willBuild,
		StorePathSet &	willSubstitute,
		StorePathSet &	unknown,
		uint64_t &	downloadSize,
		uint64_t &	narSize )

inlineoverridevirtual

Given a set of paths that are to be built, return the set of derivations that will be built, and the set of output paths that will be substituted.

Reimplemented from nix::Store.

◆ queryPartialDerivationOutputMap()

kj::Promise< Result< std::map< std::string, std::optional< StorePath > > > > nix::RestrictedStore::queryPartialDerivationOutputMap	(	const StorePath &	path,
		Store *	evalStore = nullptr )

inlineoverridevirtual

Query the mapping outputName => outputPath for the given derivation. All outputs are mentioned so ones mising the mapping are mapped to std::nullopt.

Reimplemented from nix::Store.

◆ queryPathFromHashPart()

kj::Promise< Result< std::optional< StorePath > > > nix::RestrictedStore::queryPathFromHashPart ( const std::string & hashPart )

inlineoverridevirtual

Query the full store path given the hash part of a valid store path, or empty if the path doesn't exist.

Implements nix::Store.

◆ queryPathInfoUncached()

kj::Promise< Result< std::shared_ptr< const ValidPathInfo > > > nix::RestrictedStore::queryPathInfoUncached ( const StorePath & path )

inlineoverridevirtual

Queries the path info without caching. Note to implementors: should return nullptr when the path is not found.

Implements nix::Store.

◆ queryRealisationUncached()

kj::Promise< Result< std::shared_ptr< const Realisation > > > nix::RestrictedStore::queryRealisationUncached ( const DrvOutput & id )

inlineoverridevirtual

Implements nix::Store.

◆ queryReferrers()

kj::Promise< Result< void > > nix::RestrictedStore::queryReferrers	(	const StorePath &	path,
		StorePathSet &	referrers )

inlineoverridevirtual

Queries the set of incoming FS references for a store path. The result is not cleared.

Reimplemented from nix::Store.

◆ registerDrvOutput()

kj::Promise< Result< void > > nix::RestrictedStore::registerDrvOutput ( const Realisation & output )

inlineoverridevirtual

Add a mapping indicating that deriver!outputName maps to the output path output.

This is redundant for known-input-addressed and fixed-output derivations as this information is already present in the drv file, but necessary for floating-ca derivations and their dependencies as there's no way to retrieve this information otherwise.

Reimplemented from nix::Store.

The documentation for this struct was generated from the following file:

lix/libstore/build/local-derivation-goal.cc

Public Member Functions

Public Attributes

Additional Inherited Members

Member Function Documentation

◆ addBuildLog()

◆ addIndirectRoot()

◆ addSignatures()

◆ addTempRoot()

◆ addTextToStore()

◆ addToStore()

◆ addToStoreFlat()

◆ addToStoreFromDump()

◆ addToStoreRecursive()

◆ buildDerivation()

◆ buildPaths()

◆ buildPathsWithResults()

◆ collectGarbage()

◆ config() [1/2]

◆ config() [2/2]

◆ ensurePath()

◆ findRoots()

◆ getBuildLogExact()

◆ getRealStoreDir()

◆ getUri()

◆ isTrustedClient()

◆ narFromPath()

◆ queryAllValidPaths()

◆ queryMissing()

◆ queryPartialDerivationOutputMap()

◆ queryPathFromHashPart()

◆ queryPathInfoUncached()

◆ queryRealisationUncached()

◆ queryReferrers()

◆ registerDrvOutput()