Where are the cryptographic signatures? (SHA256SUMS, Release.gpg)

7

If you want to verify these by hand, I’ve used vi/curve25519tool successfully in the past. The cache.nixos.org public key is here and needs turning into hex:

echo '6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' | base64 -d | xxd -ps -c 999
e8d087743e7d5f8df5a34816ca96ccac051191b275e993cc4051aca5c0d28636

Then you need to do the same the signature in the narinfo; using the above vim example:

echo 'HemTnbuCmk1bg9cQRxUvgalZbZgcgKU7x1ETGOdAIZksyn3sre6SCwtVVrSo4XsDy4HsuQzSKmNXw1UN0HwJBQ==' | base64 -d | xxd -ps -c 9999
1de9939dbb829a4d5b83d71047152f81a9596d981c80a53bc7511318e74021992cca7decadee920b0b5556b4a8e17b03cb81ecb90cd22a6357c3550dd07c0905

Finally verify the signature over the narinfo ‘fingerprint’ which is “1;<store path>;<narhash>;<narsize>;<comma separated references>”:

echo -n "1;/nix/store/zr70kfh830qgwz4ld8c3fc01va8wd7va-vim-9.1.0765;sha256:1a9wyq4y9klqi4lz9z4az9x6q3lqjypgbgcklyy3x1c2v3zlxfww;42777576;"\
"/nix/store/ci63zxxcf7dlfx25g8g5971r0cdx7nj1-gawk-5.2.2,/nix/store/k2wspf0nq81hxjwxsnb8r9cg08qngdk2-bash-5.2p32,/nix/store/mcln7vd9r6p72s6m1lm1jbjnmfbwxj3l-ncurses-6.4.20221231,"\
"/nix/store/qii6jadf3xrhg4y0f5m09k11lh5ymwnv-glibc-2.40-36,/nix/store/zr70kfh830qgwz4ld8c3fc01va8wd7va-vim-9.1.0765"  | \
 ./curve25519tool_linux64 verify e8d087743e7d5f8df5a34816ca96ccac051191b275e993cc4051aca5c0d28636 \
1de9939dbb829a4d5b83d71047152f81a9596d981c80a53bc7511318e74021992cca7decadee920b0b5556b4a8e17b03cb81ecb90cd22a6357c3550dd07c0905  \
 --ed && echo ok
Signed release ISOs