Nix signing experiments

test.sh

#!/bin/sh

set -e

rm -rf unsigned

unsigned="file:///$PWD/unsigned"

# show that content addressed store paths verify without signatures
ca=$(nix store add-path ./file --store "$unsigned")
nix path-info --json "$ca" --store "$unsigned"
nix store verify "$ca" --store "$unsigned"

cat <<EOF > default.nix
{ pkgs ? import <nixpkgs> {}}:  pkgs.fetchurl {
  url = "https://gist.githubusercontent.com/arianvp/b64b592f8ce081747222320ccf6094e1/raw/f32a3269abcc96e187f496149bebb4702dba584e/gistfile1.txt";
  hash = "sha256-LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=";
}
EOF

# show that FODs verify without signatures
fod=$(nix-build)
nix copy --to "$unsigned" "$fod"
nix path-info --json "$fod" --store "$unsigned"
nix store verify "$fod" --store "$unsigned"


nix key generate-secret --key-name key > key
nix key convert-secret-to-public < key > key.pub


nix key generate-secret --key-name key2 > key2
nix key convert-secret-to-public < key2 > key2.pub

rm -rf signed

signed="file:///$PWD/signed?secret-key=key"
nix copy --to "$signed" "$fod"

nix path-info --json "$fod" --store "$signed" 

# configure with wrong key on purpose
# still succeeds. Nix seems to just ignore signatures for FODs completely
nix store verify "$fod" --store "file:///$PWD/signed" --extra-trusted-public-keys $(cat key2.pub)