git.delta.rocks / jrsonnet / refs/commits / fcbbd811def9

259	location: GenerationStorage,259	location: GenerationStorage,
260	generation: PathBuf,260	generation: PathBuf,
261) -> Result<PathBuf> {261) -> Result<PathBuf> {
262	let local_host = config.local_host();
263	if matches!(location, GenerationStorage::Pusher) {262	if matches!(location, GenerationStorage::Pusher) {
264		bail!("pusher is not enabled in this version of fleet");263		bail!("pusher is not enabled in this version of fleet");
265	}264	}
266	if !host.local {265	if !host.local {
267		info!("uploading system closure");266		info!("uploading system closure");
268		{
269			// TODO: Move to remote_derivation method.
270			// Alternatively, nix store make-content-addressed can be used,
271			// at least for the first deployment, to provide trusted store key.
272			//
273			// It is much slower, yet doesn't require root on the deployer machine.
274			let Ok(mut sign) = local_host.cmd("nix").await else {
275				bail!("failed to setup local");
276			};
277			// Private key for host machine is registered in nix-sign.nix
278			sign.arg("store")
279				.arg("sign")
280				.comparg("--key-file", "/etc/nix/private-key")
281				.arg("-r")
282				.arg(&generation);
283			if let Err(e) = sign.sudo().run_nix().await {
284				warn!("failed to sign store paths: {e}");
285			};
286		}
287		let mut tries = 0;267		let mut tries = 0;
288		loop {268		loop {
289			match host.remote_derivation(&generation).await {269			match host.remote_derivation(&generation).await {

--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -456,6 +456,20 @@
 			// Path is located locally, thus already trusted.
 			return Ok(path.to_owned());
 		}
+		let mut sign = MyCommand::new(
+			// TODO: Look at the current escalation strategy.
+			// ... or switch to run0 right after polkit update
+			EscalationStrategy::Sudo,
+			"nix",
+		);
+		sign.arg("store")
+			.arg("sign")
+			.comparg("--key-file", "/etc/nix/private-key")
+			.arg("-r")
+			.arg(&path);
+		if let Err(e) = sign.sudo().run_nix().await {
+			warn!("failed to sign store paths: {e}");
+		}
 		let mut nix = MyCommand::new(
 			// Not used
 			EscalationStrategy::Su,

--- a/crates/nix-eval/src/lib.rs
+++ b/crates/nix-eval/src/lib.rs
@@ -308,7 +308,6 @@
 }
 
 static GLOBAL_STATE: LazyLock<GlobalState> = LazyLock::new(|| {
-	info!("initializing nix global state");
 	GlobalState::new().expect("global state init shouldn't fail")
 });