Hi Liliana and Ludo',
Thank you for the enlightening conversation 5 years ago. Original thread:
https://lists.gnu.org/archive/html/guix-devel/2021-10/msg00186.html
(I don't whether it is possible to reply to a mailing list post that I
did not actually receive, so I'm just mocking it.)
Op Vrijdag, 22 Okt 2021 06:47:47 +0200, Liliana Marie Prikler schreef:
Am Donnerstag, den 21.10.2021, 22:13 +0200 schrieb Ludovic Courtès:
Liliana Marie Prikler <[email protected]> skribis:
> let's say I wanted to add my own substitute server to my
> config.scm.
> At the time of writing, I would have to add said server's public
> key to
> the authorized-keys of my guix-configuration like so:
> (cons* (local-file "my-key.pub") %default-authorized-guix-keys)
[...]
Note that you could use ‘plain-file’ instead of ‘local-file’ and
inline the key canonical sexp in there.
>> [...]
>
Yes, but for that I'd have to either write a (multi-line) string
directly, which visibly "breaks" indentation of the rest of the file,
Indeed! I had several things like this in my config.scm:
(simple-service
'guix-authorized-keys guix-service-type
(guix-extension
(authorized-keys
(list (plain-file "ci.guix.gnu.org.pub.pub"
"(public-key
(ecc
(curve Ed25519)
(q #8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394#)
)
)")))))
Horror! You have spoiled me, with 'scheme everywhere'.
> However, it turns out that the format for said key files is some
> actually pretty readable Lisp-esque stuff.
Yeah it’s frustrating that canonical sexps are almost, but not quite,
Scheme sexps. :-)
(gcrypt pk-crypto) has a ‘canonical-sexp->sexp’ procedure
That works! I now have this in my config.scm:
(define (authorized-key-from-base16 file-name public-key)
(plain-file file-name
(canonical-sexp->string
(sexp->canonical-sexp
`(public-key
(ecc (curve Ed25519)
(q ,(base16-string->bytevector
(string-downcase public-key)))))))))
(simple-service
'guix-authorized-keys guix-service-type
(guix-extension
(authorized-keys
(list
(authorized-key-from-base16
"ci.guix.gnu.org.pub.pub"
"8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394")
)))) ; <- these lonelies fit on the previous line, just not in email
Much better. Especially because I now only need 3 lines per added
authorized key. (I'd like to `guix copy` between al my machines.)
base16 is used so the string is the same as in the .pub file.
Anyone a suggestion for how to do this better? (This is already
iteration four.)
The chain from string -> bytevector -> sexp -> canonical-sexp -> string
-> file -> ... seems a bit overkill, but I couldn't figure out a nicer
way to do this while minimizing the use of code-in-a-string.
Would providing an example in the doc that uses ‘canonical-sexp-
>sexp’ and its dual help?
>
I'm not sure whether it'd be in the doc or as a cookbook entry, but
providing an example would in my opinion definitely help.
I'll think about adding something in the documentation within the
context of updating the error message from `guix copy`:
https://codeberg.org/guix/guix/pulls/6831 .
Hugo
