Questions about "Untrusted paths"

Help
1

I found my nix store contains some untrusted paths by running nix store verify --all

error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/16pln0qv68dbxd8qlqhzig68dkzjyw8i-cantarell-fonts-0.111' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/6105i8mfqzjkz0y1rhynb34vr9hqg5sl-source-code-pro-2.030' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/bzjd66sdi85rwj7kd3zcdsi52xzhx69c-nix-wallpaper-simple-dark-gray.png' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/cdcgcd5lxvgfli4k5g1yl9nslhs474mg-hwdata-0.316' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/dbn507rrsmgmdxwknhb3554nmkl0kvgi-gyre-fonts-2.005' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/ism4vryr6cklc2wcank1aadxvnyv6mm1-nixos-20.03pre202088.e89b21504f3' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/qb82wpjaf3j6pswhk73rkcd43si2nb1w-nix-wallpaper-simple-dark-gray_bottom.png' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/sksvv8dacm5k66hinhyhlckbjqx1s351-source-sans-pro-3.006' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/srjp3lv3qfand8pwsj8np32yw1q4f7ms-intel2200BGFirmware-3.1' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/szphjhh0j68yhddyw2zh8ykr00mhd1r2-publicsuffix-list-2019-05-24' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/xmp5w9p9jb4r2nq8sa1wyc33s6ymq198-zd1211-firmware-1.5' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/y1hybm8h1kln0hg06c42m4g1wsblc0ig-freefont-ttf-20120503' is untrusted
error: --- Untrusted path ---------------------------------------------------------------------------------------------------------------------------------- nix
path '/nix/store/y4q0n7igsiagm91hgd0q8hrnicii4nyj-nixos.svg' is untrusted

My questions:

  1. Why are these paths marked as untrusted?
  2. I guess these paths are unstrusted because there is no attached signature in the store, how can I fetch the signature or at least check if there is a corresponding signature in the substituter? nix store copy-sigs does not accept store paths as installables and these paths do not have a deriver (according to nix-store -q --deriver).
4 Likes
2

This is a good question. I just ran this and found 100s of untrusted paths and a few corrupt ones.

3

You’re correct, the paths are untrusted because of missing signatures. You can get them from the binary cache.

nix verify -s https://cache.nixos.org

4

It should be nix store copy-sigs -s https://cache.nixos.org <store-path>

5

Hey community!

In the last days I tried out to setup a (local) binary cache (proxy) w/ harmonia, ncps and ncro on a new machine.
During that I had some problems here and there and dug deeper and deeper into the nix store topic/rabbit hole.

ATM (details below) I have a very messed-up nix store w/ some untrusted store paths.
I tried to fix them w/o luck: trusting the official signature produces the error public key is not valid and copying/importing the sig w/ nix store copy-sigshas (seems to have) no effect …

→ Maybes someone can plz have a look on it and/or try to give me some advice/ideas to fix the current state!?

Thanks in advance + KR!

PS: I also found some (maybe) related (and older) GH issues, like ignoring substitute for <path> as it's not signed by any of the keys in `trusted-public-keys` -- but it appears to be? · Issue #8254 · NixOS/nix · GitHub and this discussion Re-signing packages for caches - #3 by aanderse

error: public key is not valid

Here I try to verify a single untrusted path w/ explicit trust for the official signature of cache.nixos.org:

$ nix store verify /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9
path '/nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9' is untrusted

$ nix path-info --json --json-format 2 /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9|jq
{
  "info": {
    "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9": {
      "ca": null,
      "deriver": "9kyh02xmqnbhymygqxlap5ipsxip7a9b-bash-5.3p9.drv",
      "narHash": "sha256-2HS7BkG5X2yk1LkGzmUvsba7YlB6FvnzWndzeAk/c9g=",
      "narSize": 1856848,
      "references": [
        "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9",
        "avld9cdn23zab2ssl30h2r6444rqh6ms-glibc-2.42-67"
      ],
      "registrationTime": 1785994095,
      "signatures": [
        "cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw=="
      ],
      "storeDir": "/nix/store",
      "ultimate": false,
      "version": 2
    }
  },
  "storeDir": "/nix/store",
  "version": 2
}

$ curl -s https://cache.nixos.org/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9.narinfo
StorePath: /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9
URL: nar/1n3k7w4phwvpbbrzj5ksa1ibpdmi5xjww1mrsjj6qpxr843bnx6q.nar.zst
Compression: zstd
FileHash: sha256:1f3ssxfvi365x3ys165dxqvyccd5k7549cwdw7h0jdkvp5s0flvn
FileSize: 649755
NarHash: sha256:1n3k7w4phwvpbbrzj5ksa1ibpdmi5xjww1mrsjj6qpxr843bnx6q
NarSize: 1856848
References: 1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9 avld9cdn23zab2ssl30h2r6444rqh6ms-glibc-2.42-67
Deriver: 9kyh02xmqnbhymygqxlap5ipsxip7a9b-bash-5.3p9.drv
Sig: cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw==

$ nix --option trusted-public-keys cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw== store verify /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9
error: public key is not valid

As you can see cache.nixos.org gives me the official signature for that path (cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw==) that matches the local signature of the untrusted path and nix says it’s not a valid key. – How …?

nix store copy-sigs

Then I tried to update the signature w/ nix store copy-sigsfrom cache.nixos.org, like suggested above.

$ nix store verify -s https://cache.nixos.org/ /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9
path '/nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9' is untrusted

$ nix store copy-sigs -s https://cache.nixos.org/ /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9

$ nix path-info --json --json-format 2 /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9|jq
{
  "info": {
    "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9": {
      "ca": null,
      "deriver": "9kyh02xmqnbhymygqxlap5ipsxip7a9b-bash-5.3p9.drv",
      "narHash": "sha256-2HS7BkG5X2yk1LkGzmUvsba7YlB6FvnzWndzeAk/c9g=",
      "narSize": 1856848,
      "references": [
        "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9",
        "avld9cdn23zab2ssl30h2r6444rqh6ms-glibc-2.42-67"
      ],
      "registrationTime": 1785994095,
      "signatures": [
        "cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw=="
      ],
      "storeDir": "/nix/store",
      "ultimate": false,
      "version": 2
    }
  },
  "storeDir": "/nix/store",
  "version": 2
}

$ sudo nix store copy-sigs -s https://cache.nixos.org/ /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9

$ nix path-info --json --json-format 2 /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9|jq
{
  "info": {
    "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9": {
      "ca": null,
      "deriver": "9kyh02xmqnbhymygqxlap5ipsxip7a9b-bash-5.3p9.drv",
      "narHash": "sha256-2HS7BkG5X2yk1LkGzmUvsba7YlB6FvnzWndzeAk/c9g=",
      "narSize": 1856848,
      "references": [
        "1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9",
        "avld9cdn23zab2ssl30h2r6444rqh6ms-glibc-2.42-67"
      ],
      "registrationTime": 1785994095,
      "signatures": [
        "cache.nixos.org-1:aW1POGbWqZXoY3Tsqk24cPmz3u0oCOBhuHQ24BmVaUCcj2zz9yzI/9vLo19Syu0RmTocYt9eo2rz+Nx0tQcxAw=="
      ],
      "storeDir": "/nix/store",
      "ultimate": false,
      "version": 2
    }
  },
  "storeDir": "/nix/store",
  "version": 2
}

$ nix store delete /nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9
0 store paths deleted, 0.0 KiB freed
error: Cannot delete path '/nix/store/1sr8rmx4v0v994lkbzhwc1f0qr1gxxs9-bash-5.3p9' since it is still alive. To find out why, use: nix-store --query --roots and nix-store --query --referrers