Signing store paths: Difference between revisions
m package -> store path |
Add usage example |
||
| Line 16: | Line 16: | ||
The keys will look like this: | The keys will look like this: | ||
# cat nix-cache-priv-key | # cat nix-cache-priv-key | ||
# cat nix-cache-pub-key | cache.example.org-1:MKk58wILGij4+VKU5xXESsU+MnslTUKfCjX/9OEXq6c6lhrq8lbOw9UpHeAC46rkpXf7/jJ0KmhnjIXcpVrT0Q== | ||
# cat nix-cache-pub-key | |||
cache.example.org-1:OpYa6vJWzsPVKR3gAuOq5KV3+/4ydCpoZ4yF3KVa09E= | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 41: | Line 43: | ||
And here on non-NixOS: | And here on non-NixOS: | ||
{{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=conf}} | {{File|3=trusted-public-keys = cache.nixos.org-1:AAAAAAA...= cache.example.org-1:BBBBBBB...=|name=/etc/nix.conf|lang=conf}} | ||
== Usage == | |||
Now you can copy store paths without signatures from the NixOS binary cache to a remote!<syntaxhighlight lang="shell-session"> | |||
$ # Note that we're not a trusted user as that could allow copying without valid signatures | |||
$ nix store --store ssh-ng://anothermachine.local info | |||
Store URL: ssh-ng://anothermachine.local | |||
Version: 2.34.7 | |||
Trusted: 0 | |||
$ # Yet we can copy store paths built on this machine | |||
$ nix build --impure --expr "let pkgs = import <nixpkgs> { }; in pkgs.hello.overrideAttrs { pname = \"hello-$SECONDS\"; }" | |||
$ # Note how cache.nixos.org-1 isn't mentioned here: | |||
$ nix path-info ./result --sigs | |||
/nix/store/... ultimate cache.example.org-1:AAAAAAAAA...== | |||
$ nix copy ./result --to ssh-ng://anothermachine.local | |||
</syntaxhighlight> | |||
[[Category:Tutorial]] | [[Category:Tutorial]] | ||