wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-13 17:10:47 +02:00
Code Activity

* Use setre[ug]id() instead of setres[ug]id(), since the former is

Browse source 
more common than the latter (which exists only on Linux and
  FreeBSD).  We don't really care about dropping the saved IDs since
  there apparently is no way to quiry them in any case, so it can't
  influence the build (unlike the effective IDs which are checked by
  Perl for instance).
This commit is contained in:
Eelco Dolstra 2004-09-09 15:55:31 +00:00
parent e043fc7d0b
commit 5396304c73
5 changed files with 88 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

28
doc/manual/bugs.xml
View file

@ -1,7 +1,6 @@
<appendix>
<title>Bugs / To-Do</title>
<appendix><title>Bugs / To-Do</title>
<itemizedlist>
<itemizedlist>
<listitem>
<para>
@ -99,17 +98,18 @@ $ nix-store -r $(cat /nix/var/nix/roots/bla)</screen>
</para>
</listitem>
<listitem>
<para>
For security, <command>nix-push</command> manifests should be
digitally signed, and <command>nix-pull</command> should
verify the signatures. The actual NAR archives in the cache
do not need to be signed, since the manifest contains
cryptographic hashes of these files (and
<filename>fetchurl.nix</filename> checks them).
</para>
</listitem>
<listitem><para>For security, <command>nix-push</command> manifests
should be digitally signed, and <command>nix-pull</command> should
verify the signatures. The actual NAR archives in the cache do not
need to be signed, since the manifest contains cryptographic hashes of
these files (and <filename>fetchurl.nix</filename> checks
them).</para></listitem>
</itemizedlist>
<listitem><para>We should switch away from MD5, since it has been
cracked. We don't currently depend very much on the
collision-resistance of MD5, but we will once we start sharing build
results between users.</para></listitem>
</itemizedlist>
</appendix>