-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Post build hook signing #7408
Post build hook signing #7408
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Makes sense semantically speaking. And I actually like this style better. Deferring to @fricklerhandwerk for merging.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @endgame! Left suggestions for wording. Also please note the general contribution guidelines, which you probably have not seen because they are not linked in the Nix contribution guide. (We will catch up eventually, but you're warmly invited to make a PR to the manual!)
@NixOS/documentation-team This whole directory are tutorials which don't really belong here. We should maintain them anyway, and move them to nix.dev eventually.
5003cd8
to
8748bdf
Compare
Rewritten to capture the spirit of suggestions, plus some guesses at the anchors in the conf-file (how do I check those?). |
The docs used to recommend calling `nix store sign` in a post-build hook, but on more recent versions of nix, this results in unsigned store paths being copied into binary caches. See NixOS#6960 for details. Instead, use the `secret-key-files` config option, which signs all locally-built derivations with the private key.
8748bdf
to
a4a103d
Compare
At the worst, the anchors are visible in the manual: https://nixos.org/manual/nix/unstable/command-ref/conf-file.html There is also a file which generates them, which I'm about to make more readable: #7379 |
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/tweag-nix-dev-update-41/23848/1 |
* docs: Use secret-key-files when demonstrating post-build-hooks The docs used to recommend calling `nix store sign` in a post-build hook, but on more recent versions of nix, this results in unsigned store paths being copied into binary caches. See NixOS#6960 for details. Instead, use the `secret-key-files` config option, which signs all locally-built derivations with the private key. Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
At least until #6960 is fixed, switch the recommended approach to one which signs all derivations that end up in binary caches.