git.scottworley.com Git - trustix-integration-tests/blob - checks/one-publisher.nix

   1 { lib, gnused, nixos, nixosTest, trustix, trustixSrc, writeShellScript
   2 , writeText, }:
   3 let
   4   inherit (lib) filterAttrs hasPrefix mapAttrsToList optional;
   5
   6   trustixModule = trustixSrc + "/nixos";
   7
   8   trustixKeyConfig = writeText "trustixKeyConfig" ''
   9     { pkgs, ... }: {
  10       config = {
  11         system.activationScripts.trustix-create-key = '''
  12           if [[ ! -e /keys/trustix-priv ]];then
  13             mkdir -p /keys
  14             ''${pkgs.trustix}/bin/trustix generate-key --privkey /keys/trustix-priv --pubkey /keys/trustix-pub
  15           fi
  16         ''';
  17       };
  18     }
  19   '';
  20
  21   binaryCacheKeyConfig = writeText "binaryCacheKeyConfig" ''
  22     { pkgs, ... }: {
  23       config = {
  24         system.activationScripts.trustix-create-key = '''
  25           if [[ ! -e /keys/cache-priv-key.pem ]];then
  26             mkdir -p /keys
  27             ''${pkgs.nix}/bin/nix-store --generate-binary-cache-key clint /keys/cache-priv-key.pem /keys/cache-pub-key.pem
  28           fi
  29         ''';
  30       };
  31     }
  32   '';
  33
  34   publisherConfig = writeText "publisherConfig" ''
  35     {
  36       services.trustix = {
  37         enable = true;
  38         signers.aisha-snakeoil = {
  39           type = "ed25519";
  40           ed25519 = { private-key-path = "/keys/trustix-priv"; };
  41         };
  42         publishers = [{
  43           signer = "aisha-snakeoil";
  44           protocol = "nix";
  45           publicKey = {
  46             type = "ed25519";
  47             pub = "@trustixPubKey@";
  48           };
  49         }];
  50       };
  51     }
  52   '';
  53
  54   log-local-builds = writeShellScript "log-local-builds" ''
  55     echo "$OUT_PATHS" >> /var/log/local-builds
  56   '';
  57
  58   clientConfig = writeText "clientConfig" ''
  59     { lib, ... }: {
  60       services.trustix-nix-cache = {
  61         enable = true;
  62         private-key = "/keys/cache-priv-key.pem";
  63         port = 9001;
  64       };
  65       nix = {
  66         binaryCaches = lib.mkForce [ "http//localhost:9001" ];
  67         binaryCachePublicKeys = lib.mkForce [ "clint://@binaryCachePubKey@" ];
  68       };
  69       services.trustix = {
  70         enable = true;  # Fails with and without: https://github.com/tweak/trustix/issue/24
  71         subscribers = [{
  72           protocol = "nix";
  73           publicKey = {
  74             type = "ed25519";
  75             pub = "@trustixPubKey@";
  76           };
  77         }];
  78         remotes = [ "grpc+http://alisha/" ];
  79         deciders.nix = {
  80           engine = "percentage";
  81           percentage.minimum = 66;
  82         };
  83       };
  84       nix.extraOptions = '''
  85         post-build-hook = ${log-local-builds}
  86       ''';
  87     }
  88   '';
  89
  90   mkConfig =
  91     { config, trustixPubKeyPath, binaryCachePubKeyPath ? "/dev/null", }:
  92     writeShellScript "mkConfig" ''
  93       set -euxo pipefail
  94       mkdir -p /etc/nixos
  95       ${gnused}/bin/sed "
  96         s,@trustixPubKey@,$(< ${trustixPubKeyPath}),
  97         s,@binaryCachePubKey@,$(< ${binaryCachePubKeyPath}),
  98         " ${config} > /etc/nixos/local.nix
  99       cat > /etc/nixos/configuration.nix <<EOF
 100       {
 101         imports = [
 102           ${../lib/nixosTest-rebuild-switch.nix}
 103           ${trustixModule}
 104           ./local.nix
 105         ];
 106       }
 107       EOF
 108     '';
 109
 110 in nixosTest {
 111   name = "one-publisher";
 112   nodes = {
 113     alisha = { pkgs, ... }: {
 114       imports = [
 115         ../lib/nixosTest-rebuild-switch.nix
 116         trustixModule
 117         "${trustixKeyConfig}"
 118       ];
 119       system.extraDependencies = [
 120         pkgs.hello.inputDerivation
 121         pkgs.remarshal # For building trustix-config.toml
 122         (nixos {
 123           imports = [
 124             ../lib/nixosTest-rebuild-switch.nix
 125             trustixModule
 126             "${trustixKeyConfig}"
 127             "${publisherConfig}"
 128           ];
 129         }).toplevel
 130       ];
 131       virtualisation.diskSize = "1000";
 132       virtualisation.memorySize = "1G";
 133     };
 134     clint = { pkgs, ... }: {
 135       imports = [
 136         ../lib/nixosTest-rebuild-switch.nix
 137         trustixModule
 138         "${binaryCacheKeyConfig}"
 139       ];
 140       system.extraDependencies = [
 141         pkgs.hello.inputDerivation
 142         pkgs.remarshal # For building trustix-config.toml
 143         (nixos {
 144           imports = [
 145             ../lib/nixosTest-rebuild-switch.nix
 146             trustixModule
 147             "${binaryCacheKeyConfig}"
 148             "${clientConfig}"
 149           ];
 150         }).toplevel
 151       ];
 152       virtualisation.diskSize = "1000";
 153       virtualisation.memorySize = "1G";
 154     };
 155   };
 156   testScript = ''
 157     from os import getenv
 158     from threading import Thread
 159
 160     alisha.wait_for_file("/keys/trustix-pub")
 161     alisha.copy_from_vm("/keys/trustix-pub")
 162     clint.copy_from_host(getenv("out") + "/trustix-pub", "/keys/alisha-signing-pub")
 163
 164     clint.wait_for_file("/keys/cache-priv-key.pem")
 165     clint_thread = Thread(
 166         target=lambda: clint.succeed(
 167             "${
 168               mkConfig {
 169                 config = clientConfig;
 170                 trustixPubKeyPath = "/keys/alisha-signing-pub";
 171                 binaryCachePubKeyPath = "/keys/cache-priv-key.pem";
 172               }
 173             }",
 174             "nixos-rebuild switch --show-trace",
 175         )
 176     )
 177     clint_thread.start()
 178
 179     alisha.succeed(
 180         "${
 181           mkConfig {
 182             config = publisherConfig;
 183             trustixPubKeyPath = "/keys/trustix-pub";
 184           }
 185         }",
 186         "nixos-rebuild switch --show-trace",
 187     )
 188     alisha.succeed("nix-build '<nixpkgs>' -A hello")
 189
 190     clint_thread.join()
 191     clint.succeed("nix-build '<nixpkgs>' -A hello")
 192     clint.fail("grep hello /var/log/local-builds")
 193   '';
 194 }