mirror of
https://github.com/privatevoid-net/nix-super.git
synced 2024-11-29 17:16:15 +02:00
* Temporary notes on how we're going to use OpenSSL.
This commit is contained in:
parent
8181a1c3bb
commit
3390c1be76
1 changed files with 24 additions and 0 deletions
24
doc/signing.txt
Normal file
24
doc/signing.txt
Normal file
|
@ -0,0 +1,24 @@
|
||||||
|
Generate a private key:
|
||||||
|
|
||||||
|
$ openssl genrsa -out mykey.sec 2048
|
||||||
|
|
||||||
|
The private key should be kept secret (only readable to the Nix daemon
|
||||||
|
user).
|
||||||
|
|
||||||
|
|
||||||
|
Generate the corresponding public key:
|
||||||
|
|
||||||
|
$ openssl rsa -in mykey.sec -pubout > mykey.pub
|
||||||
|
|
||||||
|
The public key should be copied to all machines to which you want to
|
||||||
|
export store paths.
|
||||||
|
|
||||||
|
|
||||||
|
Signing:
|
||||||
|
|
||||||
|
$ nix-hash --type sha256 --flat svn.nar | openssl rsautl -sign -inkey mykey.sec > svn.nar.sign
|
||||||
|
|
||||||
|
|
||||||
|
Verifying a signature:
|
||||||
|
|
||||||
|
$ test "$(nix-hash --type sha256 --flat svn.nar)" = "$(openssl rsautl -verify -inkey mykey.pub -pubin -in svn.nar.sign)"
|
Loading…
Reference in a new issue