Morgan Arnold b5745a327e publish: Prevent publication of non-substitutable derivation outputs. ...

This commit prevents Guix substitute servers from distributing binaries
which are marked non-substitutable.  This prevents substitute servers
from accidentally committing copyright violations by distributing
binaries that are non-substitutable for copyright reasons.

* guix/scripts/publish.scm (render-nar): Query the derivers of
‘store-path’ and do nothing if one of them does not match
‘substitutable-derivation?’.
* tests/publish.scm ("non-substitutable derivation"): New test.

Change-Id: Iaca81f5bdb430a12a3ad41e9b83e0bcc535af607
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Modified-by: Ludovic Courtès <ludo@gnu.org>

2025-06-06 18:41:19 +02:00

..

build

guix: gnu-dist: Fix distcheck.

2025-06-06 14:41:30 +03:00

build-system

build-system: zig: Expose #:zig-build-target.

2025-05-26 10:41:03 +08:00

import

import: texlive: Import the given version when specified.

2025-05-24 15:29:10 +02:00

platforms

guix: Add loongarch platform.

2025-01-25 01:05:22 +08:00

scripts

publish: Prevent publication of non-substitutable derivation outputs.

2025-06-06 18:41:19 +02:00

store

deduplication: Detect holes and create sparse files.

2024-05-25 16:44:42 +02:00

tests

tests: http: Allow responses to specify a path.

2023-05-31 23:25:24 +02:00

android-repo-download.scm

download: Refer to the 'guile-gnutls' package and not 'gnutls'.

2023-05-11 13:23:08 +02:00

avahi.scm

avahi: Fix exception when #:timeout is #f.

2023-07-11 15:47:56 +02:00

base16.scm

…

base32.scm

guix: Strip #:use-module lists.

2023-03-13 15:08:33 +01:00

base64.scm

…

build-system.scm

…

bzr-download.scm

download: Honor ‘GUIX_DOWNLOAD_METHODS’ environment variable.

2024-03-09 18:55:50 +01:00

cache.scm

cache: Remove unused import.

2025-04-14 17:31:49 +02:00

channels.scm

maint: Change main repository URL to git.guix.gnu.org.

2025-05-23 11:19:07 +02:00

ci.scm

ci: Catch error for unreachable channel with substitutes.

2024-07-23 16:24:38 +02:00

colors.scm

…

combinators.scm

…

config.scm.in

build: Add dependency on Git.

2023-09-26 17:36:58 +02:00

cpio.scm

…

cpu.scm

guix: cpu: Add detection for znver5.

2024-09-30 13:38:33 +03:00

cve.scm

…

cvs-download.scm

download: Honor ‘GUIX_DOWNLOAD_METHODS’ environment variable.

2024-03-09 18:55:50 +01:00

d3.v3.js

…

deprecation.scm

deprecation: Fix docstring typo.

2023-12-22 17:47:15 +01:00

derivations.scm

derivations: Fix indentation.

2025-02-22 23:55:24 +09:00

describe.scm

ui: Search channels for guix extensions

2025-03-08 17:40:58 +01:00

diagnostics.scm

diagnostics: Factorize 'absolute-location'.

2023-05-31 23:25:25 +02:00

discovery.scm

Autoload (guix build syscalls).

2024-04-15 22:36:42 +02:00

docker.scm

pack: Include store parent directories in the Docker layer.

2025-06-03 15:09:54 +02:00

download.scm

download: Remove unreachable mirror URL.

2025-04-03 22:28:10 +09:00

elf.scm

…

ftp-client.scm

ftp-client: 'connect*' retries until the timeout has expired.

2023-05-04 13:08:59 +02:00

gexp.scm

gexp: Add symlink-to procedure.

2025-05-21 08:05:27 +09:00

git-authenticate.scm

guix: Avoid ‘fdatasync’ call for caches and regular files.

2025-04-14 17:31:50 +02:00

git-download.scm

git-download: Use C.UTF-8 and remove dependency on ‘glibc-utf8-locales’.

2024-08-31 10:44:46 +02:00

git.scm

git: Remove code for Guile-Git < 0.10.0.

2025-05-18 22:55:53 +02:00

glob.scm

…

gnu-maintenance.scm

import: Guard against potential type error.

2025-05-17 13:10:11 +09:00

gnupg.scm

gnupg: Automatically fallback to 'always policy when non-interactive.

2025-02-28 13:36:44 +09:00

grafts.scm

grafts: Allow file-like objects in the ‘replacement’ field of <graft>.

2025-01-28 14:56:14 +01:00

graph.js

…

graph.scm

graph: Add GraphML backend.

2023-08-25 14:24:43 +02:00

hash.scm

scripts: hash: Handle repository with different VCS folders.

2024-07-23 16:27:27 +02:00

hg-download.scm

hg-download: Pass strings to ‘hg-fetch’.

2024-06-12 09:45:44 +02:00

http-client.scm

guix: Avoid ‘fdatasync’ call for caches and regular files.

2025-04-14 17:31:50 +02:00

i18n.scm

…

inferior.scm

inferior: Add #:verify-certificate? to ‘cached-channel-instance’.

2024-12-25 23:51:10 +01:00

ipfs.scm

guix: Strip #:use-module lists.

2023-03-13 15:08:33 +01:00

least-authority.scm

least-authority: Export default preserved environment variables.

2025-04-19 21:13:21 +09:00

licenses.scm

licenses: Add blue-oak1.0.0.

2024-11-20 18:01:35 +08:00

lint.scm

gnu: Rename texlive-updmap.cfg' into texlive-local-tree'.

2025-05-06 11:25:06 +02:00

man-db.scm

man-db: Support mdoc-formatted man pages.

2025-04-11 12:18:02 +02:00

memoization.scm

…

modules.scm

modules: ‘file-name->module-name’ strips leading “./”.

2024-07-18 17:31:19 +02:00

monad-repl.scm

monad-repl: Add REPL commands to inspect package arguments.

2023-12-04 22:26:38 +01:00

monads.scm

gexp: ‘with-parameters’ properly handles ‘%graft?’.

2025-03-05 00:28:49 +01:00

nar.scm

Autoload (guix build syscalls).

2024-04-15 22:36:42 +02:00

narinfo.scm

substitute: If a server's nar URL is 404, try the next one(s).

2023-05-30 00:15:29 +02:00

openpgp.scm

…

packages.scm

packages: Add riscv64-linux to %cuirass-supported-systems.

2025-04-25 20:25:27 +02:00

pki.scm

guix: Strip #:use-module lists.

2023-03-13 15:08:33 +01:00

platform.scm

guix: platform: Add platform-rust-target.

2023-12-11 13:50:48 +02:00

profiles.scm

gnu: profiles.scm: Ignore ls-R databases when building font maps.

2025-05-06 11:25:06 +02:00

profiling.scm

…

progress.scm

tests: Import (guix build syscalls) when (guix build store-copy) is used.

2023-11-25 16:29:25 +01:00

quirks.scm

…

read-print.scm

read-print: Attempt to indent package arguments less.

2025-02-09 01:00:00 +01:00

records.scm

records: Fix ABI check in cross-compilation context.

2024-11-18 10:58:42 +01:00

remote.scm

remote: Do not double-quote the repl-command.

2024-12-12 12:52:08 +01:00

repl.scm

…

rpm.scm

…

scripts.scm

Autoload (guix build syscalls).

2024-04-15 22:36:42 +02:00

search-paths.scm

search-paths: $Add XDG_DATA_DIRS.

2025-03-18 16:12:38 +09:00

self.scm

self: Install systemd ‘.service’ files.

2025-04-20 17:58:11 +02:00

serialization.scm

guix: Strip #:use-module lists.

2023-03-13 15:08:33 +01:00

sets.scm

…

ssh.scm

ssh: Add #:strict-host-key-check? option.

2025-02-09 18:20:42 +01:00

status.scm

status: Guard against a numerical overflow condition.

2023-04-12 08:29:37 -04:00

store.scm

gexp: ‘with-parameters’ properly handles ‘%graft?’.

2025-03-05 00:28:49 +01:00

substitutes.scm

guix: Avoid ‘fdatasync’ call for caches and regular files.

2025-04-14 17:31:50 +02:00

svn-download.scm

guix: download-multi-svn-to-store: Allow exporting from base URL.

2024-08-31 10:45:36 +02:00

swh.scm

swh: Specify 'extid_version' when looking up by external ID.

2024-06-26 23:56:56 +02:00

tests.scm

guix: tests: Increase timeout for test store connection.

2024-08-01 10:32:31 +01:00

transformations.scm

transformations: Git source transformations honour RECURSIVE?.

2025-05-05 12:15:47 +02:00

ui.scm

ui: Allow evaluating multi-expressions strings with read/eval.

2025-05-09 23:05:26 +09:00

upstream.scm

upstream: Do not update to same version.

2025-04-27 13:01:48 +01:00

utils.scm

utils: Add #:sync? parameter to ‘with-atomic-file-output’.

2025-04-14 17:31:49 +02:00

workers.scm

…