mirror of
https://github.com/NixOS/nix.git
synced 2025-11-16 23:42:43 +01:00
a47e055e09
These settings are not needed for libstore at all, they are just used by the nix daemon *command* for authorization on unix domain sockets. My moving them to a new configuration struct just in that file, we avoid them leaking anywhere else. Also, it is good to break up the mammoth `Settings` struct in general. Issue #5638 tracks this. The message is not changed because I do not want to regress in convenience to the user. Just saying "this connection is not trusted" doesn't tell them out to fix the issue. The ideal thing to do would be to somehow parameterize `processCommand` on how the error should be displayed, so different sorts of connections can display different information to the user based on how authentication is performed for the connection in question. This, however, is a good bit more work, so it is left for the future. This came up with me thinking about the tcp:// store (#5265). The larger project is not TCP *per se*, but the idea that it should be possible for something else to manage access control to services like the Nix Daemon, and those services simply trust or trust the incoming connection as they are told. This is a more capability-oriented way of thinking about trust than "every server implements its own auth separately" as we are used to today. Its very great that libstore itself already implements just this model, and so via this refactor I basically want to "enshrine" that so it continues to be the case. |
||
|---|---|---|
| .. | ||
| build | ||
| builtins | ||
| tests | ||
| binary-cache-store.cc | ||
| binary-cache-store.hh | ||
| build-result.hh | ||
| builtins.hh | ||
| ca-specific-schema.sql | ||
| content-address.cc | ||
| content-address.hh | ||
| crypto.cc | ||
| crypto.hh | ||
| daemon.cc | ||
| daemon.hh | ||
| derivations.cc | ||
| derivations.hh | ||
| derived-path.cc | ||
| derived-path.hh | ||
| dummy-store.cc | ||
| export-import.cc | ||
| filetransfer.cc | ||
| filetransfer.hh | ||
| fs-accessor.hh | ||
| gc-store.hh | ||
| gc.cc | ||
| globals.cc | ||
| globals.hh | ||
| http-binary-cache-store.cc | ||
| legacy-ssh-store.cc | ||
| local-binary-cache-store.cc | ||
| local-fs-store.cc | ||
| local-fs-store.hh | ||
| local-store.cc | ||
| local-store.hh | ||
| local.mk | ||
| lock.cc | ||
| lock.hh | ||
| log-store.cc | ||
| log-store.hh | ||
| machines.cc | ||
| machines.hh | ||
| make-content-addressed.cc | ||
| make-content-addressed.hh | ||
| misc.cc | ||
| names.cc | ||
| names.hh | ||
| nar-accessor.cc | ||
| nar-accessor.hh | ||
| nar-info-disk-cache.cc | ||
| nar-info-disk-cache.hh | ||
| nar-info.cc | ||
| nar-info.hh | ||
| nix-store.pc.in | ||
| optimise-store.cc | ||
| outputs-spec.cc | ||
| outputs-spec.hh | ||
| parsed-derivations.cc | ||
| parsed-derivations.hh | ||
| path-info.cc | ||
| path-info.hh | ||
| path-regex.hh | ||
| path-with-outputs.cc | ||
| path-with-outputs.hh | ||
| path.cc | ||
| path.hh | ||
| pathlocks.cc | ||
| pathlocks.hh | ||
| profiles.cc | ||
| profiles.hh | ||
| realisation.cc | ||
| realisation.hh | ||
| references.cc | ||
| references.hh | ||
| remote-fs-accessor.cc | ||
| remote-fs-accessor.hh | ||
| remote-store.cc | ||
| remote-store.hh | ||
| repair-flag.hh | ||
| s3-binary-cache-store.cc | ||
| s3-binary-cache-store.hh | ||
| s3.hh | ||
| schema.sql | ||
| serve-protocol.hh | ||
| sqlite.cc | ||
| sqlite.hh | ||
| ssh-store.cc | ||
| ssh.cc | ||
| ssh.hh | ||
| store-api.cc | ||
| store-api.hh | ||
| store-cast.hh | ||
| uds-remote-store.cc | ||
| uds-remote-store.hh | ||
| worker-protocol.hh | ||