Signing store paths: Difference between revisions

Line 1:

== Setup ==

This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual.

This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the [[Nix (package manager)|Nix]] manual.

=== Signing Key ===

You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the ~~host name~~ of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi~~.local~~</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">

You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the [[Wikipedia:Hostname|hostname]] of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">

# mkdir -pv /var/secrets

# cd /var/secrets

@@ Line 1: / Line 1: @@
 == Setup ==
-This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the Nix manual.
+This is based on the {{manual|nix|advanced-topics/post-build-hook.html|Set up a Signing Key|subsection=set-up-a-signing-key}} section of the [[Nix (package manager)|Nix]] manual.
 === Signing Key ===
-You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the host name of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi.local</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">
+You need a signing key to sign [[Nix store|store]] paths. The key name (<code>cache.example.org-1</code> for example) can be anything, but it's suggested to use the [[Wikipedia:Hostname|hostname]] of your cache/store (e.g. <code>cache.example.org</code> or <code>raspberrypi</code>) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).<ref>https://nix.dev/manual/nix/2.34/command-ref/new-cli/nix3-key-generate-secret.html</ref> You can create a signing key using the {{Manual|nix|command-ref/nix-store/generate-binary-cache-key|<code>nix-store --generate-binary-cache-key</code>}} or the {{Manual|nix|command-ref/new-cli/nix3-key-generate-secret|<code>nix key generate-secret</code>}} commands.<syntaxhighlight lang="shell-session">
 # mkdir -pv /var/secrets
 # cd /var/secrets