Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sign released Nix tarballs #17

Closed
edolstra opened this issue May 10, 2012 · 4 comments
Closed

Sign released Nix tarballs #17

edolstra opened this issue May 10, 2012 · 4 comments
Assignees
Milestone

Comments

@edolstra
Copy link
Member

Official releases should be cryptographically signed off-site.

@ghost ghost assigned edolstra May 10, 2012
@joeyh
Copy link

joeyh commented Feb 9, 2014

I agree. I can't use nix until it's cryptographically secure.

@shlevy
Copy link
Member

shlevy commented Feb 9, 2014

You can build nix from source and turn off unsigned binary caches at least.

@vcunat
Copy link
Member

vcunat commented Feb 10, 2014

Note that https channels fail, because they're signed by Amazon and not nixos.org (hydra's https binary cache works). I'm not saying https is of great security, but it seems better than plaintext.

edolstra added a commit that referenced this issue Apr 25, 2017
Add :i command to install a derivation to the current profile.
@shlevy shlevy added the triaged label Apr 1, 2018
aszlig pushed a commit to aszlig/nix that referenced this issue Aug 18, 2018
@edolstra
Copy link
Member Author

Closing since releases have been GPG-signed for a while.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants