[partially solved here: https://plus.google.com/110416349762686874861/posts/PVGHL1Tpeb9; but not entirely]
I want to use one of my NixOS machines as a cache for the packages, to not pull everything from Hydra for each one on every upgrade. So I try to do this: https://nixos.org/nix/manual/#sec-sharing-packages. But
When I try to use
nix-serve -p <port>,
nix-env --option extra-binary-caches http://<host>:<port>/(even when run as
root!) just ignores this cache, saying that "NAR info file" ... "lacks a signature", and attempts to switch to
nix-servedoesn't work as expected. Does it mean that the documentation is not actual anymore, or that
nix-copy-closure --to <user>@<host>does work (if
<user>is added as trusted user into
nix.trustedUsers). But doing this on every upgrade would be very inconvenient. BTW. What also puzzles me here is how
--fromis supposed to be used?
I have general understanding of how cryptographic signatures work, and why they are used to sign packages (and repositories). But
In these circumstances I simply don't need it: the risk of a MITM is not something to worry about. I just want to copy few GiB's of binaries from one machine to another, regularly and effortlessly. I could, of course, simply disable the verification completely via
nix.requireSignedBinaryCaches = false, but isn't there a less radical way? If, say, I invoke
root, or as a "trusted user" and have this "extra" binary cache registered as "trusted binary cache"; doesn't it imply that I know what I'm doing, and don't need the system nagging about missing signatures? (without the need for disabling the checking altogether) I haven't found how to disable the verification only for a certain "trusted" source/user, and pretty much suspect it doesn't exist (i.e. bug).
I could probably also, to comply with this signing mechanism, try to set up a "full-fledged" binary cache, by making use of
nix-store --generate-binary-cache-key, then
nix-push --dest <somewhere> --key-file <secret-1> --none <cherrypicked-paths>, and registering the public key on the client(s). But it's quite not what I want: storing the archives on the "server" and setting the paths for
nix-pushexplicitly. I just want that either
nix-servesigned those shared packages before delivery, so that the receiving side would be happy, or
nix-envto not complain about the lack of signing, if I'm absolutely sure that this particular source is trustworthy!
In conclusion: I'm pretty sure
nix-serve or the signature checking mechanism (or both) are simply broken/unmaintained. So one can consider it all less as a question, more as a bug report candidate. But if I'm wrong -- yet better.