Signing store paths: Difference between revisions
m package -> store path |
Specify that trusting is to be done on a separate machine |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 16: | Line 16: | ||
The keys will look like this: | The keys will look like this: | ||
# cat nix-cache-priv-key | # cat nix-cache-priv-key | ||
# cat nix-cache-pub-key | cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q== | ||
# cat nix-cache-pub-key | |||
cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E= | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 26: | Line 28: | ||
}|name=/etc/nixos/configuration.nix|lang=nix}} | }|name=/etc/nixos/configuration.nix|lang=nix}} | ||
And here on non-NixOS: | And here on non-NixOS: | ||
{{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang= | {{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang=ini}} | ||
=== Signing already-built store paths === | === Signing already-built store paths === | ||
| Line 34: | Line 36: | ||
=== Trusting store paths using a signing key === | === Trusting store paths using a signing key === | ||
On a machine that you want to trust the signed store's store paths, configure the Nix option {{manual|nix|command-ref/conf-file|<code>trusted-public-keys</code>|subsection=conf-trusted-public-keys}} with thepublic key from <code>/var/secrets/nix-cache-pub-key</code> on the machine with the signed store. Here is how you do it on NixOS: | |||
{{File|3={ | {{File|3={ | ||
# NixOS automatically includes the public key of the NixOS binary cache | # NixOS automatically includes the public key of the NixOS binary cache | ||
| Line 40: | Line 42: | ||
}|name=/etc/nixos/configuration.nix|lang=nix}} | }|name=/etc/nixos/configuration.nix|lang=nix}} | ||
And here on non-NixOS: | And here on non-NixOS: | ||
{{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang= | {{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=ini}} | ||
== Usage == | |||
Now you can copy store paths without signatures from the NixOS binary cache to a remote! You can continue by setting up [[Distributed build|remote builders]] or a [[Binary Cache|binary cache]], or simply using <code>nix copy</code>. | |||
=== <code>nix copy</code> example === | |||
<syntaxhighlight lang="shell-session"> | |||
$ # Note that we're not a trusted user as that could allow copying without valid signatures | |||
$ nix store --store ssh-ng://anothermachine.local info | |||
Store URL: ssh-ng://anothermachine.local | |||
Version: 2.34.7 | |||
Trusted: 0 | |||
$ # Yet we can copy store paths built on this machine | |||
$ nix build --impure --expr "let pkgs = import <nixpkgs> { }; in pkgs.hello.overrideAttrs { pname = \"hello-$SECONDS\"; }" | |||
$ # Note how cache.nixos.org-1 isn't mentioned here: | |||
$ nix path-info ./result --sigs | |||
/nix/store/... ultimate cache.example.org-1:AAAAAAAAA...== | |||
$ nix copy ./result --to ssh-ng://anothermachine.local | |||
</syntaxhighlight> | |||
[[Category:Tutorial]] | [[Category:Tutorial]] | ||