nix3-key-generate-secret(1)

📦
version 2.35.3 · 10 versions
, in fedora 44

💅 nix3-key-generate-secret(1) — from the General Commands Manual, bestie 💖

⚠️ Warning, no cap: this program is experimental and its interface is subject to change. So like... learn it, love it, but don't get too attached to the exact vibes. ✨

🌸 Name

nix key generate-secret — generate a secret key for signing store paths 👑

✨ Synopsis

nix key generate-secret [option…]

🎀 Examples

  • Okay so first, manifest a brand new secret key:
# nix key generate-secret --key-name cache.example.org-1 > ./secret-key

Now bestie, we can use that key to sign the closure of the Hello package:

# nix build nixpkgs#hello
# nix store sign --key-file ./secret-key --recursive ./result

And finally (the glow-up moment 💖), we verify the store paths using the corresponding public key:

# nix store verify --trusted-public-keys $(nix key convert-secret-to-public < ./secret-key) ./result

🦋 Description

This command generates a new Ed25519 secret key for signing store paths and prints it on standard output. And then, to get the corresponding public key for verifying signed store paths, you hit up nix key convert-secret-to-public. iconic duo fr fr 💫

The mandatory argument --key-name specifies a key name (such as cache.example.org-1). It's used to look up keys on the client when it verifies signatures — like a lil name tag so the client knows who's who 🙈. It can literally be anything, but it's suggested to use the host name of your cache (e.g. cache.example.org) with a suffix denoting the number of the key — and you bump that number up every single time you need to revoke a key. Stay safe out there 💅

🌈 Format

Both secret and public keys are represented as the key name followed by a Base64 encoding of the Ed25519 key data, e.g.

cache.example.org-0:E7lAO+MsPwTFfPXsdPtW8GKui/5ho4KQHVcAGnX+Tti1V4dUxoVoqLyWJ4YESuZJwQ67GVIksDt47og+tPVUZw==

💖 Options

  • --key-name name — Identifier of the key (e.g. cache.example.org-1).
  • --debug — Set the logging verbosity level to 'debug'. (maximum yapping, we love that 🫶)
  • --log-format format — Set the format of log output; one of raw, internal-json, bar or bar-with-logs.
  • --print-build-logs, -L — Print full build logs on standard error.
  • --quiet — Decrease the logging verbosity level. (shhh 🤫)
  • --verbose, -v — Increase the logging verbosity level.

⭐ Miscellaneous global options

  • --help — Show usage information. (your bestie when you're lost 🧚)
  • --offline — Disable substituters and consider all previously downloaded files up-to-date.
  • --option name value — Set the Nix configuration setting name to value (overriding nix.conf).
  • --refresh — Consider all previously downloaded files out-of-date.
  • --version — Show version information.
📝 Note: See man nix.conf for overriding configuration settings with command line flags. iykyk 💜

And that's the whole page, babe — signed, sealed, delivered ✨ This was page nix3-key-generate-secret(1) from the General Commands Manual, brought to you by the absolute legends behind Nix. now go sign some store paths, you main character 🎀💅🔥

📦 where this page comes from