Add support for signing store paths using ML-DSA-65

src/libfetchers/git-lfs-fetch.cc

@@ -8,6 +8,7 @@
 #include "nix/util/util.hh"
 #include "nix/util/hash.hh"
 #include "nix/store/ssh.hh"
+#include "nix/util/deleter.hh"
 
 #include <git2/attr.h>
 #include <git2/config.h>

src/libfetchers/git-utils.cc

@@ -14,6 +14,7 @@
 #include "nix/util/thread-pool.hh"
 #include "nix/util/pool.hh"
 #include "nix/util/executable-path.hh"
+#include "nix/util/deleter.hh"
 
 #include <git2/attr.h>
 #include <git2/blob.h>

src/libfetchers/include/nix/fetchers/git-utils.hh

@@ -136,17 +136,6 @@ struct GitRepo
     virtual Hash dereferenceSingletonDirectory(const Hash & oid) = 0;
 };
 
-// A helper to ensure that the `git_*_free` functions get called.
-template<auto del>
-struct Deleter
-{
-    template<typename T>
-    void operator()(T * p) const
-    {
-        del(p);
-    };
-};
-
 // A helper to ensure that we don't leak objects returned by libgit2.
 template<typename T>
 struct Setter

src/libutil/include/nix/util/deleter.hh

@@ -0,0 +1,19 @@
+#pragma once
+
+namespace nix {
+
+/**
+ * A helper for `std::unique_ptr` that ensures that C APIs that require manual memory management get properly freed. The
+ * template parameter `del` is a function that takes a pointer and frees it.
+ */
+template<auto del>
+struct Deleter
+{
+    template<typename T>
+    void operator()(T * p) const
+    {
+        del(p);
+    };
+};
+
+} // namespace nix

src/libutil/include/nix/util/file-system.hh

@@ -12,6 +12,7 @@
 #include "nix/util/types.hh"
 #include "nix/util/file-descriptor.hh"
 #include "nix/util/file-path.hh"
+#include "nix/util/deleter.hh"
 
 #include <filesystem>
 #include <sys/types.h>
@@ -374,15 +375,7 @@ public:
     }
 };
 
-struct DIRDeleter
-{
-    void operator()(DIR * dir) const
-    {
-        closedir(dir);
-    }
-};
-
-typedef std::unique_ptr<DIR, DIRDeleter> AutoCloseDir;
+typedef std::unique_ptr<DIR, Deleter<closedir>> AutoCloseDir;
 
 /**
  * Create a temporary directory.

src/libutil/include/nix/util/meson.build

@@ -31,6 +31,7 @@ headers = [ config_pub_h ] + files(
   'config-impl.hh',
   'configuration.hh',
   'current-process.hh',
+  'deleter.hh',
   'demangle.hh',
   'english.hh',
   'environment-variables.hh',

src/libutil/include/nix/util/signature/local-keys.hh

@@ -41,8 +41,16 @@ struct Signature
     auto operator<=>(const Signature &) const = default;
 };
 
+enum KeyType {
+    Ed25519,
+    MLDSA65,
+};
+
+KeyType parseKeyType(std::string_view s);
+
 struct Key
 {
+    KeyType type;
     std::string name;
     std::string key;
 
@@ -59,8 +67,9 @@ protected:
      */
     Key(std::string_view s, bool sensitiveValue);
 
-    Key(std::string_view name, std::string && key)
-        : name(name)
+    Key(KeyType type, std::string_view name, std::string && key)
+        : type(type)
+        , name(name)
         , key(std::move(key))
     {
     }
@@ -79,11 +88,11 @@ struct SecretKey : Key
 
     PublicKey toPublicKey() const;
 
-    static SecretKey generate(std::string_view name);
+    static SecretKey generate(std::string_view name, KeyType type);
 
 private:
-    SecretKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key))
+    SecretKey(KeyType type, std::string_view name, std::string && key)
+        : Key(type, name, std::move(key))
     {
     }
 };
@@ -107,8 +116,8 @@ struct PublicKey : Key
     bool verifyDetachedAnon(std::string_view data, const Signature & sig) const;
 
 private:
-    PublicKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key))
+    PublicKey(KeyType type, std::string_view name, std::string && key)
+        : Key(type, name, std::move(key))
     {
     }
     friend struct SecretKey;