signed.md

Generate a keypair:

nix-store --generate-binary-cache-key example.org /path/to/secret /path/to/public

Use that to push signed paths:

• For usage through the nix cli nix copy --to s3://example?secret-key=/path/to/secret <path>

• in hydra config store_uri = s3://example?secret-key=/path/to/secret

From client side:

• make sure the binary cache is added to the trusted substituters through nix.trustedBinaryCaches (trusted-substituters in nix.conf)

  nix.trustedBinaryCaches = [ s3://example ];

• make sure to add the content of /path/to/public to nix.binaryCachePublicKeys or trusted-public-keys in nix.conf