mirror of
https://github.com/privatevoid-net/nix-super.git
synced 2024-12-02 02:16:15 +02:00
48 lines
1.3 KiB
Markdown
48 lines
1.3 KiB
Markdown
R""(
|
||
|
||
# Examples
|
||
|
||
* Generate a new secret key:
|
||
|
||
```console
|
||
# nix key generate-secret --key-name cache.example.org-1 > ./secret-key
|
||
```
|
||
|
||
We can then use this key to sign the closure of the Hello package:
|
||
|
||
```console
|
||
# nix build nixpkgs#hello
|
||
# nix store sign --key-file ./secret-key --recursive ./result
|
||
```
|
||
|
||
Finally, we can verify the store paths using the corresponding
|
||
public key:
|
||
|
||
```
|
||
# nix store verify --trusted-public-keys $(nix key convert-secret-to-public < ./secret-key) ./result
|
||
```
|
||
|
||
# Description
|
||
|
||
This command generates a new Ed25519 secret key for signing store
|
||
paths and prints it on standard output. Use `nix key
|
||
convert-secret-to-public` to get the corresponding public key for
|
||
verifying signed store paths.
|
||
|
||
The mandatory argument `--key-name` specifies a key name (such as
|
||
`cache.example.org-1). It is used to look up keys on the client when
|
||
it verifies signatures. It can be anything, but it’s suggested to use
|
||
the host name of your cache (e.g. `cache.example.org`) with a suffix
|
||
denoting the number of the key (to be incremented every time you need
|
||
to revoke a key).
|
||
|
||
# Format
|
||
|
||
Both secret and public keys are represented as the key name followed
|
||
by a base-64 encoding of the Ed25519 key data, e.g.
|
||
|
||
```
|
||
cache.example.org-0:E7lAO+MsPwTFfPXsdPtW8GKui/5ho4KQHVcAGnX+Tti1V4dUxoVoqLyWJ4YESuZJwQ67GVIksDt47og+tPVUZw==
|
||
```
|
||
|
||
)""
|