Signing store paths - Revision history

Axka: Specify that trusting is to be done on a separate machine

2026-07-03T15:55:37Z

Specify that trusting is to be done on a separate machine

← Older revision		Revision as of 15:55, 3 July 2026
Line 36:		Line 36:

	=== Trusting store paths using a signing key ===		=== Trusting store paths using a signing key ===
	~~Read~~ the ~~public key from <code>/var/secrets/nix-cache-pub-key</code> and~~ configure the Nix option {{manual\|nix\|command-ref/conf-file\|<code>trusted-public-keys</code>\|subsection=conf-trusted-public-keys}} with it. Here is how you do it on NixOS:		On a machine that you want to trust the signed store's store paths, configure the Nix option {{manual\|nix\|command-ref/conf-file\|<code>trusted-public-keys</code>\|subsection=conf-trusted-public-keys}} with thepublic key from <code>/var/secrets/nix-cache-pub-key</code> on the machine with the signed store. Here is how you do it on NixOS:
	{{File\|3={		{{File\|3={
	# NixOS automatically includes the public key of the NixOS binary cache		# NixOS automatically includes the public key of the NixOS binary cache

Axka: Use lang=ini for nix.conf

2026-07-03T15:53:02Z

Use lang=ini for nix.conf

← Older revision		Revision as of 15:53, 3 July 2026
Line 28:		Line 28:
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}
	And here on non-NixOS:		And here on non-NixOS:
	{{File\|3=secret-key-files = /var/secrets/nix-cache-priv-key\|name=/etc/nix.conf\|lang=~~conf~~}}		{{File\|3=secret-key-files = /var/secrets/nix-cache-priv-key\|name=/etc/nix.conf\|lang=ini}}

	=== Signing already-built store paths ===		=== Signing already-built store paths ===
Line 42:		Line 42:
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}
	And here on non-NixOS:		And here on non-NixOS:
	{{File\|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=\|name=/etc/nix.conf\|lang=~~conf~~}}		{{File\|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=\|name=/etc/nix.conf\|lang=ini}}

	== Usage ==		== Usage ==

Axka: More examples

2026-07-03T15:48:09Z

More examples

← Older revision		Revision as of 15:48, 3 July 2026
Line 45:		Line 45:

	== Usage ==		== Usage ==
	Now you can copy store paths without signatures from the NixOS binary cache to a remote!<syntaxhighlight lang="shell-session">		Now you can copy store paths without signatures from the NixOS binary cache to a remote! You can continue by setting up [[Distributed build\|remote builders]] or a [[Binary Cache\|binary cache]], or simply using <code>nix copy</code>.

			=== <code>nix copy</code> example ===
			<syntaxhighlight lang="shell-session">
	$ # Note that we're not a trusted user as that could allow copying without valid signatures		$ # Note that we're not a trusted user as that could allow copying without valid signatures
	$ nix store --store ssh-ng://anothermachine.local info		$ nix store --store ssh-ng://anothermachine.local info

Axka: Add usage example

2026-07-03T15:42:09Z

Add usage example

@@ Line 16: / Line 16: @@
 The keys will look like this:
-# cat nix-cache-priv-key # cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==%
+# cat nix-cache-priv-key
-# cat nix-cache-pub-key # cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E=%
+cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==
 </syntaxhighlight>
@@ Line 41: / Line 43: @@
 And here on non-NixOS:
 {{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=conf}}
 [[Category:Tutorial]]

Axka: package -> store path

2026-07-03T14:49:57Z

package -> store path

← Older revision		Revision as of 14:49, 3 July 2026
Line 28:		Line 28:
	{{File\|3=secret-key-files = /var/secrets/nix-cache-priv-key\|name=/etc/nix.conf\|lang=conf}}		{{File\|3=secret-key-files = /var/secrets/nix-cache-priv-key\|name=/etc/nix.conf\|lang=conf}}

	=== Signing already-built ~~packages~~ ===		=== Signing already-built store paths ===
	When you add a key to <code>secret-key-files</code>, Nix does not automatically sign ~~packages~~ that have already been built. You must run the {{Manual\|nix\|command-ref/new-cli/nix3-store-sign\|<code>nix store sign</code>}} command to do that.<syntaxhighlight lang="shell-session">		When you add a key to <code>secret-key-files</code>, Nix does not automatically sign store paths that have already been built. You must run the {{Manual\|nix\|command-ref/new-cli/nix3-store-sign\|<code>nix store sign</code>}} command to do that.<syntaxhighlight lang="shell-session">
	# nix store sign --all --key-file /var/secrets/nix-cache-priv-key		# nix store sign --all --key-file /var/secrets/nix-cache-priv-key
	</syntaxhighlight>		</syntaxhighlight>

Axka: Add links

2026-07-03T14:49:14Z

Add links

← Older revision		Revision as of 14:49, 3 July 2026
Line 1:		Line 1:
	== Setup ==		== Setup ==
	This is based on the {{manual\|nix\|advanced-topics/post-build-hook.html\|Set up a Signing Key\|subsection=set-up-a-signing-key}} section of the Nix manual.		This is based on the {{manual\|nix\|advanced-topics/post-build-hook.html\|Set up a Signing Key\|subsection=set-up-a-signing-key}} section of the [[Nix (package manager)\|Nix]] manual.

	=== Signing Key ===		=== Signing Key ===
	You need a signing key to sign [[Nix store\|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the ~~host name~~ of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi~~.local~~</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual\|nix\|command-ref/nix-store/generate-binary-cache-key\|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual\|nix\|command-ref/new-cli/nix3-key-generate-secret\|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">		You need a signing key to sign [[Nix store\|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the [[Wikipedia:Hostname\|hostname]] of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual\|nix\|command-ref/nix-store/generate-binary-cache-key\|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual\|nix\|command-ref/new-cli/nix3-key-generate-secret\|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">
	# mkdir -pv /var/secrets		# mkdir -pv /var/secrets
	# cd /var/secrets		# cd /var/secrets

Axka: Created page with "== Setup == This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual. === Signing Key === You need a signing key to sign store paths. The key name (`cache.example.org-1` for example) can be anything, but it's suggested to use the host name of your cache/store (e.g. `cache.example.org` or `raspberrypi.local`) with a suffix denoting..."

2026-07-03T14:45:30Z

Created page with "== Setup == This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual. === Signing Key === You need a signing key to sign store paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the host name of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi.local</code>) with a suffix denoting..."

New page

== Setup ==
This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual.

=== Signing Key ===
You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the host name of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi.local</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">
# mkdir -pv /var/secrets
# cd /var/secrets

Using the old CLI:
# nix-store --generate-binary-cache-key cache.example.org-1 nix-cache-priv-key nix-cache-pub-key

Using the new nix CLI:
# nix key generate-secret --key-name cache.example.org-1 > nix-cache-priv-key
# chmod 0600 nix-cache-priv-key # make the private key inaccessible to other users
# nix key convert-secret-to-public < nix-cache-priv-key > nix-cache-pub-key

The keys will look like this:
# cat nix-cache-priv-key # cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==%
# cat nix-cache-pub-key # cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E=%
</syntaxhighlight>

=== Auto-signing ===
To automatically sign store paths after building, you need to configure the Nix option {{manual|nix|command-ref/conf-file|<code>secret-key-files</code>|subsection=conf-secret-key-files}} with the path of the private key. Here is how you do it on NixOS:
{{File|3={
nix.settings.secret-key-files = [ "/var/secrets/nix-cache-priv-key" ];
}|name=/etc/nixos/configuration.nix|lang=nix}}
And here on non-NixOS:
{{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang=conf}}

=== Signing already-built packages ===
When you add a key to <code>secret-key-files</code>, Nix does not automatically sign packages that have already been built. You must run the {{Manual|nix|command-ref/new-cli/nix3-store-sign|<code>nix store sign</code>}} command to do that.<syntaxhighlight lang="shell-session">
# nix store sign --all --key-file /var/secrets/nix-cache-priv-key
</syntaxhighlight>

=== Trusting store paths using a signing key ===
Read the public key from <code>/var/secrets/nix-cache-pub-key</code> and configure the Nix option {{manual|nix|command-ref/conf-file|<code>trusted-public-keys</code>|subsection=conf-trusted-public-keys}} with it. Here is how you do it on NixOS:
{{File|3={
# NixOS automatically includes the public key of the NixOS binary cache
nix.settings.trusted-public-keys = [ "cache.example.org-1:BBBBBBB...=" ];
}|name=/etc/nixos/configuration.nix|lang=nix}}
And here on non-NixOS:
{{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=conf}}
[[Category:Tutorial]]