View source for Signing store paths

== Setup ==
This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the [[Nix (package manager)|Nix]] manual.

=== Signing Key ===
You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the [[Wikipedia:Hostname|hostname]] of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">
# mkdir -pv /var/secrets
# cd /var/secrets

Using the old CLI:
# nix-store --generate-binary-cache-key cache.example.org-1 nix-cache-priv-key nix-cache-pub-key

Using the new nix CLI:
# nix key generate-secret --key-name cache.example.org-1 > nix-cache-priv-key
# chmod 0600 nix-cache-priv-key # make the private key inaccessible to other users
# nix key convert-secret-to-public < nix-cache-priv-key > nix-cache-pub-key

The keys will look like this:
# cat nix-cache-priv-key
cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==
# cat nix-cache-pub-key
cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E=
</syntaxhighlight>

=== Auto-signing ===
To automatically sign store paths after building, you need to configure the Nix option {{manual|nix|command-ref/conf-file|<code>secret-key-files</code>|subsection=conf-secret-key-files}} with the path of the private key. Here is how you do it on NixOS:
{{File|3={
  nix.settings.secret-key-files = [ "/var/secrets/nix-cache-priv-key" ];
}|name=/etc/nixos/configuration.nix|lang=nix}}
And here on non-NixOS:
{{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang=ini}}

=== Signing already-built store paths ===
When you add a key to <code>secret-key-files</code>, Nix does not automatically sign store paths that have already been built. You must run the {{Manual|nix|command-ref/new-cli/nix3-store-sign|<code>nix store sign</code>}} command to do that.<syntaxhighlight lang="shell-session">
# nix store sign --all --key-file /var/secrets/nix-cache-priv-key
</syntaxhighlight>

=== Trusting store paths using a signing key ===
On a machine that you want to trust the signed store's store paths, configure the Nix option {{manual|nix|command-ref/conf-file|<code>trusted-public-keys</code>|subsection=conf-trusted-public-keys}} with thepublic key from <code>/var/secrets/nix-cache-pub-key</code> on the machine with the signed store. Here is how you do it on NixOS:
{{File|3={
  # NixOS automatically includes the public key of the NixOS binary cache
  nix.settings.trusted-public-keys = [ "cache.example.org-1:BBBBBBB...=" ];
}|name=/etc/nixos/configuration.nix|lang=nix}}
And here on non-NixOS:
{{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=ini}}

== Usage ==
Now you can copy store paths without signatures from the NixOS binary cache to a remote! You can continue by setting up [[Distributed build|remote builders]] or a [[Binary Cache|binary cache]], or simply using <code>nix copy</code>.

=== <code>nix copy</code> example ===
<syntaxhighlight lang="shell-session">
$ # Note that we're not a trusted user as that could allow copying without valid signatures
$ nix store --store ssh-ng://anothermachine.local info
Store URL: ssh-ng://anothermachine.local
Version: 2.34.7
Trusted: 0

$ # Yet we can copy store paths built on this machine
$ nix build --impure --expr "let pkgs = import <nixpkgs> { }; in pkgs.hello.overrideAttrs { pname = \"hello-$SECONDS\"; }"
$ # Note how cache.nixos.org-1 isn't mentioned here:
$ nix path-info ./result --sigs
/nix/store/... ultimate cache.example.org-1:AAAAAAAAA...==
$ nix copy ./result --to ssh-ng://anothermachine.local
</syntaxhighlight>
[[Category:Tutorial]]