Theres your problem:
Note line:
substituters = https://mirror.sjtu.edu.cn/nix-channels/store
system-features = nixos-test benchmark big-parallel kvm
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ1
The tuna cache is trying to sign pkgs with the public key from the cache.nixos.org-1: public key
China being what it is, ill copy paste the relevant sections in the nix wiki for context:
Using a binary cache
To configure Nix to use a certain binary cache, refer to the Nix manual.[cf. 4] Add the binary cache as substituter (see the options substituters and extra-substituters) and the public key to the trusted keys (see trusted-public-keys).
Permanent use of binary cache:
# /etc/nixos/configuration.nix
nix = {
settings = {
substituters = [
"http://binarycache.example.com"
"https://nix-community.cachix.org"
"https://cache.nixos.org/"
];
trusted-public-keys = [
"binarycache.example.com-1:dsafdafDFW123fdasfa123124FADSAD"
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
};
Warning: Keys that are entered incorrectly or are otherwise invalid, aside from preventing you from benefiting from the cached derivations, may also prevent you from rebuilding your system. This is most likely to occur after garbage collection (e.g., via nix-collect-garbage -d). Consult NixOS/nix#8271 for additional details and a workaround.
Temporary use of binary cache:
$ nix-store -r /nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10 --option substituters http://binarycache.example.com --option trusted-public-keys binarycache.example.com:dsafdafDFW123fdasfa123124FADSAD
these paths will be fetched (0.00 MiB download, 24.04 MiB unpacked):
/nix/store/7gx4kiv5m0i7d7qkixq2cwzbr10lvxwc-glibc-2.27
/nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
copying path '/nix/store/7gx4kiv5m0i7d7qkixq2cwzbr10lvxwc-glibc-2.27' from 'http://binarycache.example.com'...
copying path '/nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10' from 'http://binarycache.example.com'...
warning: you did not specify '--add-root'; the result might be removed by the garbage collector
/nix/store/gdh8165b7rg4y53v64chjys7mbbw89f9-hello-2.10
Short version: Your nix-config is trying to sub the nix-cache public key for signing instead of the key used for the cache you are enabling, you need to set the public key in your /etc/nixos/configuration.nix file
This source is WAY too long and descriptive to try and quote so ill just pray you can access this domain without too much issue: But this link goes to the nix.dev manual section regarding configuring in trusted keys and how to get them
https://nix.dev/manual/nix/2.24/command-ref/conf-file.html#conf-trusted-public-keys
It might also be worth just poking around the nix-channel cache you are using for the public key, it should be posted somewhere in the repo but i cannot read Chinese, its all running through a shit translator thats not very great.
Heres a template block that should work with your /etc/nixos/configuration.nix
nix.settings = {
extra-substituters = [
"https://cache.m7.rs"
"https://nix-gaming.cachix.org"
];
extra-trusted-public-keys = [
"cache.m7.rs:kszZ/NSwE/TjhOcPPQ16IuUiuRSisdiIwhKZCxguaWg="
"nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
];
};
After, you should be able to add the cache back to your nix-channel list and run a full rebuild, then reboot.
EDIT: While im thinking about, take a look at NixOS Search
There are a few different ways to declare these options, either as a single block or individually if you feel the need to declare them as separate functions
