Signing store paths: Difference between revisions
Created page with "== Setup == This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual. === Signing Key === You need a signing key to sign store paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the host name of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi.local</code>) with a suffix denoting..." |
m Add links |
||
| Line 1: | Line 1: | ||
== Setup == | == Setup == | ||
This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual. | This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the [[Nix (package manager)|Nix]] manual. | ||
=== Signing Key === | === Signing Key === | ||
You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the | You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the [[Wikipedia:Hostname|hostname]] of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session"> | ||
# mkdir -pv /var/secrets | # mkdir -pv /var/secrets | ||
# cd /var/secrets | # cd /var/secrets | ||
Revision as of 14:49, 3 July 2026
Setup
This is based on the 📖︎ Set up a Signing Key section of the Nix manual.
Signing Key
You need a signing key to sign store paths. The key name (cache.example.org-1 for example) can be anything, but it's suggested to use the hostname of your cache/store (e.g. cache.example.org or raspberrypi) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).[1] You can create a signing key using the 📖︎ nix-store --generate-binary-cache-key or the 📖︎ nix key generate-secret commands.
# mkdir -pv /var/secrets
# cd /var/secrets
Using the old CLI:
# nix-store --generate-binary-cache-key cache.example.org-1 nix-cache-priv-key nix-cache-pub-key
Using the new nix CLI:
# nix key generate-secret --key-name cache.example.org-1 > nix-cache-priv-key
# chmod 0600 nix-cache-priv-key # make the private key inaccessible to other users
# nix key convert-secret-to-public < nix-cache-priv-key > nix-cache-pub-key
The keys will look like this:
# cat nix-cache-priv-key # cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q==%
# cat nix-cache-pub-key # cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E=%
Auto-signing
To automatically sign store paths after building, you need to configure the Nix option 📖︎ secret-key-files with the path of the private key. Here is how you do it on NixOS:
{
nix.settings.secret-key-files = [ "/var/secrets/nix-cache-priv-key" ];
}
And here on non-NixOS:
secret-key-files = /var/secrets/nix-cache-priv-keySigning already-built packages
When you add a key to secret-key-files, Nix does not automatically sign packages that have already been built. You must run the 📖︎ nix store sign command to do that.
# nix store sign --all --key-file /var/secrets/nix-cache-priv-key
Trusting store paths using a signing key
Read the public key from /var/secrets/nix-cache-pub-key and configure the Nix option 📖︎ trusted-public-keys with it. Here is how you do it on NixOS:
{
# NixOS automatically includes the public key of the NixOS binary cache
nix.settings.trusted-public-keys = [ "cache.example.org-1:BBBBBBB...=" ];
}
And here on non-NixOS:
trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=