Man page - nix3-key-generate-secret(1)

Packages contains this manual

Package: nix-bin
apt-get install nix-bin

Manuals in package:

Documentations in package:

nix-bin

Manual

nix3-key-generate-secret

Name
Synopsis
Examples
Description
Format
Options
Logging-related options
Miscellaneous global options

Warning
This program is experimental and its interface is subject to change.

Name

nix key generate-secret - generate a secret key for signing store paths

Synopsis

nix key generate-secret [ option …]

Examples

•

Generate a new secret key:

# nix key generate-secret --key-name cache.example.org-1 > ./secret-key

We can then use this key to sign the closure of the Hello package:

# nix build nixpkgs#hello
# nix store sign --key-file ./secret-key --recursive ./result

Finally, we can verify the store paths using the corresponding public key:

# nix store verify --trusted-public-keys $(nix key convert-secret-to-public < ./secret-key) ./result

Description

This command generates a new Ed25519 secret key for signing store paths and prints it on standard output. Use nix key convert-secret-to-public to get the corresponding public key for verifying signed store paths.

The mandatory argument --key-name specifies a key name (such as cache.example.org-1). It is used to look up keys on the client when it verifies signatures. It can be anything, but it’s suggested to use the host name of your cache (e.g. cache.example.org) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).