The flag remembering whether an Interrupted exception was thrown is
now thread-local. Thus, all threads will (eventually) throw
Interrupted. Previously, one thread would throw Interrupted, and then
the other threads wouldn't see that they were supposed to quit.

Like "nix-store --verify --check-contents", but with the same
advantages as "nix verify-paths".

Unlike "nix-store --verify-path", this command verifies signatures in
addition to store path contents, is multi-threaded (especially useful
when verifying binary caches), and has a progress indicator.

Example use:

$ nix verify-paths --store https://cache.nixos.org -r $(type -p thunderbird)
...
[17/132 checked] checking ‘/nix/store/rawakphadqrqxr6zri2rmnxh03gqkrl3-autogen-5.18.6’

Otherwise writing to std::cerr is not thread-safe (in particular,
lines will be randomly duplicated).

Kill the temporary darwin-specific channel

The issues have been resolved upstream in the main nixpkgs channel now

Otherwise we hit the 104 character limit.

http://hydra.nixos.org/build/33562028

Doing a chdir() is a bad idea in multi-threaded programs, leading to
failures such as

  error: cannot connect to daemon at ‘/nix/var/nix/daemon-socket/socket’: No such file or directory

Since Linux doesn't have a connectat() syscall like FreeBSD, there is
no way we can support this in a race-free way.

Closes https://github.com/NixOS/hydra/pull/286.

This allows queryPathInfo() to return signatures.

This is a bit user-friendlier than using $NIX_REMOTE.

This allows applying nix-store --verify-path to binary cache stores:

  NIX_REMOTE=https://cache.nixos.org nix-store --verify-path /nix/store/s5c7...

Dockerfile: 1.9 -> 1.11.2, add more users

http://hydra.nixos.org/build/33280008

http://hydra.nixos.org/build/33279996

http://hydra.nixos.org/build/33279570

http://hydra.nixos.org/build/33073389

http://hydra.nixos.org/build/33087405

If a path is in the .narinfo cache, obviously it's valid.

Propagate path context via builtins.readFile

add docs for `nix-store --serve`

The public key can be derived from the secret key, so there's no need
for the user to supply it separately.

musl compatibility