Stabilise `nix store verify`
Open
Nobody has claimed this yet.
idea approved
new-cli
RFC
- Dominant language
- C++
- Stars
- 17.7k
- Forks
- 2k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 80
Description
This implements https://github.com/NixOS/rfcs/pull/136. This issue is agreed-upon by the @NixOS/nix-team
Required changes:
- needs documentation on the default number of signatures required
- also should say why it's important: copying a closure to a remote system loses the "ultimately trusted" bit, so before deploying, one will want to make sure it's fully signed
- signatures should be compared by key contents only, excluding names
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with RFC 136 and the nix store verify command. Review the current handling of the default signature count and signature comparison, along with the related documentation. Done means the default is documented with its deployment rationale and signatures are compared by key contents without key names.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100