Post build hook signing #7408
Post build hook signing #7408
Conversation
There was a problem hiding this comment.
Makes sense semantically speaking. And I actually like this style better. Deferring to @fricklerhandwerk for merging.
There was a problem hiding this comment.
Thanks @endgame! Left suggestions for wording. Also please note the general contribution guidelines, which you probably have not seen because they are not linked in the Nix contribution guide. (We will catch up eventually, but you're warmly invited to make a PR to the manual!)
@NixOS/documentation-team This whole directory are tutorials which don't really belong here. We should maintain them anyway, and move them to nix.dev eventually.
endgame
force-pushed
the
post-build-hook-signing
branch
from
5003cd8
to
8748bdf
Compare
|
Rewritten to capture the spirit of suggestions, plus some guesses at the anchors in the conf-file (how do I check those?). |
The docs used to recommend calling `nix store sign` in a post-build hook, but on more recent versions of nix, this results in unsigned store paths being copied into binary caches. See NixOS#6960 for details. Instead, use the `secret-key-files` config option, which signs all locally-built derivations with the private key.
endgame
force-pushed
the
post-build-hook-signing
branch
from
8748bdf
to
a4a103d
Compare
|
At the worst, the anchors are visible in the manual: https://nixos.org/manual/nix/unstable/command-ref/conf-file.html There is also a file which generates them, which I'm about to make more readable: #7379 |
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
|
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/tweag-nix-dev-update-41/23848/1 |
* docs: Use secret-key-files when demonstrating post-build-hooks The docs used to recommend calling `nix store sign` in a post-build hook, but on more recent versions of nix, this results in unsigned store paths being copied into binary caches. See NixOS#6960 for details. Instead, use the `secret-key-files` config option, which signs all locally-built derivations with the private key. Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
At least until #6960 is fixed, switch the recommended approach to one which signs all derivations that end up in binary caches.