~ruther/guix-local

0043558082d619d0dc51ef27acda8ebb299c2f2c — Ludovic Courtès 10 years ago a65e2a0
publish: Do not publish nars for invalid store items.

Before that, /nar requests could succeed if the requested store item
exists but is invalid (although such requests were unlikely because the
corresponding narinfo request would have failed.)

* guix/scripts/publish.scm (render-nar): Add 'store' parameter.  Use
'valid-path?' instead of 'file-exists?'.
(make-request-handler): Adjust 'render-nar' call accordingly.
* tests/publish.scm ("/nar/invalid"): New test.
2 files changed, 11 insertions(+), 3 deletions(-)

M guix/scripts/publish.scm
M tests/publish.scm
M guix/scripts/publish.scm => guix/scripts/publish.scm +3 -3
@@ 208,13 208,13 @@ References: ~a~%"
                     (narinfo-string store store-path (force %private-key))
                     <>)))))

(define (render-nar request store-item)
(define (render-nar store request store-item)
  "Render archive of the store path corresponding to STORE-ITEM."
  (let ((store-path (string-append %store-directory "/" store-item)))
    ;; The ISO-8859-1 charset *must* be used otherwise HTTP clients will
    ;; interpret the byte stream as UTF-8 and arbitrarily change invalid byte
    ;; sequences.
    (if (file-exists? store-path)
    (if (valid-path? store store-path)
        (values '((content-type . (application/x-nix-archive
                                   (charset . "ISO-8859-1"))))
                ;; XXX: We're not returning the actual contents, deferring


@@ 314,7 314,7 @@ blocking."
           (render-narinfo store request hash))
          ;; /nar/<store-item>
          (("nar" store-item)
           (render-nar request store-item))
           (render-nar store request store-item))
          (_ (not-found request)))
        (not-found request))))


M tests/publish.scm => tests/publish.scm +8 -0
@@ 112,6 112,14 @@ References: ~a~%"
       (call-with-input-string nar (cut restore-file <> temp)))
     (call-with-input-file temp read-string))))

(test-equal "/nar/invalid"
  404
  (begin
    (call-with-output-file (string-append (%store-prefix) "/invalid")
      (lambda (port)
        (display "This file is not a valid store item." port)))
    (response-code (http-get (publish-uri (string-append "/nar/invalid"))))))

(test-end "publish")