Signing store paths: Difference between revisions
Add usage example |
Specify that trusting is to be done on a separate machine |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 28: | Line 28: | ||
}|name=/etc/nixos/configuration.nix|lang=nix}} | }|name=/etc/nixos/configuration.nix|lang=nix}} | ||
And here on non-NixOS: | And here on non-NixOS: | ||
{{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang= | {{File|3=secret-key-files = /var/secrets/nix-cache-priv-key|name=/etc/nix.conf|lang=ini}} | ||
=== Signing already-built store paths === | === Signing already-built store paths === | ||
| Line 36: | Line 36: | ||
=== Trusting store paths using a signing key === | === Trusting store paths using a signing key === | ||
On a machine that you want to trust the signed store's store paths, configure the Nix option {{manual|nix|command-ref/conf-file|<code>trusted-public-keys</code>|subsection=conf-trusted-public-keys}} with thepublic key from <code>/var/secrets/nix-cache-pub-key</code> on the machine with the signed store. Here is how you do it on NixOS: | |||
{{File|3={ | {{File|3={ | ||
# NixOS automatically includes the public key of the NixOS binary cache | # NixOS automatically includes the public key of the NixOS binary cache | ||
| Line 42: | Line 42: | ||
}|name=/etc/nixos/configuration.nix|lang=nix}} | }|name=/etc/nixos/configuration.nix|lang=nix}} | ||
And here on non-NixOS: | And here on non-NixOS: | ||
{{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang= | {{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=ini}} | ||
== Usage == | == Usage == | ||
Now you can copy store paths without signatures from the NixOS binary cache to a remote!<syntaxhighlight lang="shell-session"> | Now you can copy store paths without signatures from the NixOS binary cache to a remote! You can continue by setting up [[Distributed build|remote builders]] or a [[Binary Cache|binary cache]], or simply using <code>nix copy</code>. | ||
=== <code>nix copy</code> example === | |||
<syntaxhighlight lang="shell-session"> | |||
$ # Note that we're not a trusted user as that could allow copying without valid signatures | $ # Note that we're not a trusted user as that could allow copying without valid signatures | ||
$ nix store --store ssh-ng://anothermachine.local info | $ nix store --store ssh-ng://anothermachine.local info | ||
Latest revision as of 15:55, 3 July 2026
Setup
This is based on the 📖︎ Set up a Signing Key section of the Nix manual.
Signing Key
You need a signing key to sign store paths. The key name (cache.example.org-1 for example) can be anything, but it's suggested to use the hostname of your cache/store (e.g. cache.example.org or raspberrypi) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).[1] You can create a signing key using the 📖︎ nix-store --generate-binary-cache-key or the 📖︎ nix key generate-secret commands.
# mkdir -pv /var/secrets
# cd /var/secrets
Using the old CLI:
# nix-store --generate-binary-cache-key cache.example.org-1 nix-cache-priv-key nix-cache-pub-key
Using the new nix CLI:
# nix key generate-secret --key-name cache.example.org-1 > nix-cache-priv-key
# chmod 0600 nix-cache-priv-key # make the private key inaccessible to other users
# nix key convert-secret-to-public < nix-cache-priv-key > nix-cache-pub-key
The keys will look like this:
# cat nix-cache-priv-key
cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==
# cat nix-cache-pub-key
cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E=
Auto-signing
To automatically sign store paths after building, you need to configure the Nix option 📖︎ secret-key-files with the path of the private key. Here is how you do it on NixOS:
{
nix.settings.secret-key-files = [ "/var/secrets/nix-cache-priv-key" ];
}
And here on non-NixOS:
secret-key-files = /var/secrets/nix-cache-priv-key
Signing already-built store paths
When you add a key to secret-key-files, Nix does not automatically sign store paths that have already been built. You must run the 📖︎ nix store sign command to do that.
# nix store sign --all --key-file /var/secrets/nix-cache-priv-key
Trusting store paths using a signing key
On a machine that you want to trust the signed store's store paths, configure the Nix option 📖︎ trusted-public-keys with thepublic key from /var/secrets/nix-cache-pub-key on the machine with the signed store. Here is how you do it on NixOS:
{
# NixOS automatically includes the public key of the NixOS binary cache
nix.settings.trusted-public-keys = [ "cache.example.org-1:BBBBBBB...=" ];
}
And here on non-NixOS:
trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=
Usage
Now you can copy store paths without signatures from the NixOS binary cache to a remote! You can continue by setting up remote builders or a binary cache, or simply using nix copy.
nix copy example
$ # Note that we're not a trusted user as that could allow copying without valid signatures
$ nix store --store ssh-ng://anothermachine.local info
Store URL: ssh-ng://anothermachine.local
Version: 2.34.7
Trusted: 0
$ # Yet we can copy store paths built on this machine
$ nix build --impure --expr "let pkgs = import <nixpkgs> { }; in pkgs.hello.overrideAttrs { pname = \"hello-$SECONDS\"; }"
$ # Note how cache.nixos.org-1 isn't mentioned here:
$ nix path-info ./result --sigs
/nix/store/... ultimate cache.example.org-1:AAAAAAAAA...==
$ nix copy ./result --to ssh-ng://anothermachine.local