Locally-built paths are now signed automatically using the secret keys
specified by the ‘secret-key-files’ option.

The 304 Not Modified was not handled correctly, so the empty result
from the conditional request would overwrite the previous tarball.

E.g.

  $ nix sign-paths -k ./secret -r $(type -p geeqie)

signs geeqie and all its dependencies using the key in ./secret.

This imports signatures from one store into another. E.g.

  $ nix copy-sigs -r /run/current-system -s https://cache.nixos.org/
  imported 595 signatures

https://hydra.nixos.org/build/33908385

These are content-addressed paths or outputs of locally performed
builds. They are trusted even if they don't have signatures, so "nix
verify-paths" won't complain about them.

In particular, this eliminates a bunch of boilerplate code.

Typical usage is to check local paths using the signatures from a
binary cache:

  $ nix verify-paths -r /run/current-system -s https://cache.nixos.org
  path ‘/nix/store/c1k4zqfb74wba5sn4yflb044gvap0x6k-nixos-system-mandark-16.03.git.fc2d7a5M’ is untrusted
  ...
  checked 844 paths, 119 untrusted

The flag remembering whether an Interrupted exception was thrown is
now thread-local. Thus, all threads will (eventually) throw
Interrupted. Previously, one thread would throw Interrupted, and then
the other threads wouldn't see that they were supposed to quit.

Like "nix-store --verify --check-contents", but with the same
advantages as "nix verify-paths".

Unlike "nix-store --verify-path", this command verifies signatures in
addition to store path contents, is multi-threaded (especially useful
when verifying binary caches), and has a progress indicator.

Example use:

$ nix verify-paths --store https://cache.nixos.org -r $(type -p thunderbird)
...
[17/132 checked] checking ‘/nix/store/rawakphadqrqxr6zri2rmnxh03gqkrl3-autogen-5.18.6’

Otherwise writing to std::cerr is not thread-safe (in particular,
lines will be randomly duplicated).

Kill the temporary darwin-specific channel

The issues have been resolved upstream in the main nixpkgs channel now

Otherwise we hit the 104 character limit.

http://hydra.nixos.org/build/33562028

Doing a chdir() is a bad idea in multi-threaded programs, leading to
failures such as

  error: cannot connect to daemon at ‘/nix/var/nix/daemon-socket/socket’: No such file or directory

Since Linux doesn't have a connectat() syscall like FreeBSD, there is
no way we can support this in a race-free way.

Closes https://github.com/NixOS/hydra/pull/286.

This allows queryPathInfo() to return signatures.

This is a bit user-friendlier than using $NIX_REMOTE.

This allows applying nix-store --verify-path to binary cache stores:

  NIX_REMOTE=https://cache.nixos.org nix-store --verify-path /nix/store/s5c7...

Dockerfile: 1.9 -> 1.11.2, add more users

http://hydra.nixos.org/build/33280008

http://hydra.nixos.org/build/33279996

http://hydra.nixos.org/build/33279570

http://hydra.nixos.org/build/33073389