Sign with multiple signing keys

[clerie]

Nix supports entries in caches to be signed by multiple keys.

This patch introduces the new config options secret_key_paths that is an array of paths to secret keys. All provided secret keys are used for signing.

[clerie]

This change breaks the SECRET_KEY_FILE environment variable currently.

I need some feedback how to integrate this, as this is used in the NixOS module. We could have an environment variable called SECRET_KEY_FILES with some character separating multiple paths, but I'm not sure about this.

[clerie]

I fixed support for signing keys passed via environment variables.

There are four ways now to specify signing keys:

• sign_key_path in config file, accepting a single file path as a string
• sign_key_paths in config file, accepting multiple file paths as strings in an array
• SIGN_KEY_PATH in environment, accepting a single file path
• SIGN_KEY_PATHS in environment, accepting multiple file paths separated by whitespace

All paths, not matter how they got specified, and all keys will be used for signing.

[wentasah]

Hi, I think that something like the previous comment should appear in the README.

[wentasah]

BTW, I sign Nix store paths with nix store sign and I need harmonia to serve these signatures instead of automatically signing the whole nix store. I opened draft PR #336, which does that. This can also result in multiple signatures of a single store path like in this PR. If your PR gets merged, I'll need to update mine, because there are obviously conflicts.

Out of curiosity, why do you need multiple signing keys?

[clerie]

Out of curiosity, why do you need multiple signing keys?

I changed the URL my cache is served under and wanted to change the keys name accordingly. It turned out, that in Nix the name is not just a hint, instead it matches if name and signature matches. So while transitioning the domains and keys, I have to sign with two keys. I found it not worth it to run multiple harmonia instances, as Nix absolutely supports multiple signing keys.

[clerie]

Out of curiosity, why do you need multiple signing keys?

I changed the URL my cache is served under and wanted to change the keys name accordingly. It turned out, that in Nix the name is not just a hint, instead it matches if name and signature matches. So while transitioning the domains and keys, I have to sign with two keys. I found it not worth it to run multiple harmonia instances, as Nix absolutely supports multiple signing keys.

[Mic92]

Out of curiosity, why do you need multiple signing keys?

I changed the URL my cache is served under and wanted to change the keys name accordingly. It turned out, that in Nix the name is not just a hint, instead it matches if name and signature matches. So while transitioning the domains and keys, I have to sign with two keys. I found it not worth it to run multiple harmonia instances, as Nix absolutely supports multiple signing keys.

Sounds like a useful way to rotate keys. So I am for having it.

[Mic92]

Change looks good to me, but can you also update the nixos module to use the new environment variables?

[clerie]

@Mic92 I updated the NixOS module.

I haven't touched the tests for it yet. Would you like to leave the test for the deprecated option and have another one for multiple signatures or should I change the existing one?

[clerie]

@Mic92 I updated the NixOS module.

I haven't touched the tests for it yet. Would you like to leave the test for the deprecated option and have another one for multiple signatures or should I change the existing one?

[Mic92]

Just change the test to the new option.

[Mic92]

@mergify rebase

[mergify[bot]]

rebase

✅ Branch has been successfully rebased

[mergify[bot]]

rebase

✅ Branch has been successfully rebased

[Mic92]

@mergify queue

[mergify[bot]]

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 3ae668e873bded4c05446cb4aa745b5de606aefc

[mergify[bot]]

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 3ae668e873bded4c05446cb4aa745b5de606aefc