difftreelog
feat sign built systems by default
in: trunk
6 files changed
cmds/fleet/src/cmds/build_systems.rsdiffbeforeafterboth191 // TODO: If rollback target exists - bail, it should be removed. Lockfile will not work in case if rollback191 // TODO: If rollback target exists - bail, it should be removed. Lockfile will not work in case if rollback192 // is scheduler on next boot (default behavior). On current boot - rollback activator will fail due to192 // is scheduler on next boot (default behavior). On current boot - rollback activator will fail due to193 // unit name conflict in systemd-run193 // unit name conflict in systemd-run194 // This code is tied to rollback.nix194 if !build.disable_rollback {195 if !build.disable_rollback {195 let _span = info_span!("preparing").entered();196 let _span = info_span!("preparing").entered();196 info!("preparing for rollback");197 info!("preparing for rollback");334 Action::Upload { action } => {335 Action::Upload { action } => {335 if !config.is_local(&host) {336 if !config.is_local(&host) {336 info!("uploading system closure");337 info!("uploading system closure");338 {339 let mut sign = MyCommand::new("sudo");340 // Private key for host machine is registered in nix-sign.nix341 sign.arg("nix")342 .arg("store")343 .arg("sign")344 .comparg("-k", "/etc/nix/private-key")345 .arg("-r")346 .arg(&built);347 if let Err(e) = sign.run_nix().await {348 warn!("Failed to sign store paths: {e}");349 };350 }337 let mut tries = 0;351 let mut tries = 0;338 loop {352 loop {339 let mut nix = MyCommand::new("nix");353 let mut nix = MyCommand::new("nix");cmds/fleet/src/command.rsdiffbeforeafterboth269 drv = pkg;269 drv = pkg;270 }270 }271 }271 }272 info!(target: "nix","copying {} {} -> {}", drv, from, to);272 // info!(target: "nix","copying {} {} -> {}", drv, from, to);273 let span = info_span!("copy", from, to, drv);273 let span = info_span!("copy", from, to, drv);274 span.pb_start();274 span.pb_start();275 self.spans.insert(id, span);275 self.spans.insert(id, span);nixos/modules/module-list.nixdiffbeforeafterboth3 ../meta.nix3 ../meta.nix4 ../secrets.nix4 ../secrets.nix5 ../rollback.nix5 ../rollback.nix6 ../nix-sign.nix6]7]78nixos/nix-sign.nixdiffbeforeafterbothno changes
nixos/rollback.nixdiffbeforeafterboth1# Tied to build_systems.rs1{config, ...}: {2{config, ...}: {2 # TODO: Make it work with systemd-initrd approach.3 # TODO: Make it work with systemd-initrd approach.3 # In this case we can't just switch generation and re-run activation script, since the root filesystem might not be4 # In this case we can't just switch generation and re-run activation script, since the root filesystem might not bescripts/install-trusted-cert.shdiffbeforeafterbothno changes